feat(core): sync framework security hardening and accessibility improvements

- add util.Go with panic recovery for background goroutines
- add util.EscapeLike and explicit ESCAPE clause for SQL LIKE queries
- add DummyCheckPassword and subtle.ConstantTimeCompare against timing attacks
- enforce session ID rotation upon login/oauth callback to prevent session fixation
- add sliding window login failure rate limiting and oauth state rate limiting
- fix redis client capture race in pubsub listeners and wait on stop channel
- adjust global --primary to oklch(51.1% 0.262 276.966) for WCAG AA contrast
- fix semantic heading levels and missing aria-labels across UI components
- document security, concurrency, and a11y standards in AGENTS.md

internal/apps/cap/manager.go

@@ -178,10 +178,13 @@ var (
 // GetDefaultManager yields the global singleton CAPTCHA manager.
 func GetDefaultManager() *Manager {
 	once.Do(func() {
-		secret := []byte("default-captcha-secret-key-at-least-16-bytes")
-		if config.Config != nil && config.Config.App.SessionSecret != "" {
+		var secret []byte
+		if config.Config != nil && strings.TrimSpace(config.Config.App.SessionSecret) != "" {
 			secret = []byte(config.Config.App.SessionSecret)
 		}
+		if len(secret) == 0 {
+			return
+		}
 
 		var store pkgcap.Store
 		if config.Config != nil && config.Config.Redis.Enabled && db.Redis != nil {