feat(core): sync framework security hardening and accessibility improvements

- add util.Go with panic recovery for background goroutines
- add util.EscapeLike and explicit ESCAPE clause for SQL LIKE queries
- add DummyCheckPassword and subtle.ConstantTimeCompare against timing attacks
- enforce session ID rotation upon login/oauth callback to prevent session fixation
- add sliding window login failure rate limiting and oauth state rate limiting
- fix redis client capture race in pubsub listeners and wait on stop channel
- adjust global --primary to oklch(51.1% 0.262 276.966) for WCAG AA contrast
- fix semantic heading levels and missing aria-labels across UI components
- document security, concurrency, and a11y standards in AGENTS.md

internal/apps/oauth/session_context.go

@@ -14,6 +14,7 @@ import (
 	"github.com/gin-contrib/sessions"
 	"github.com/gin-gonic/gin"
 	"github.com/google/uuid"
+	gsessions "github.com/gorilla/sessions"
 )
 
 // GetUserIDFromSession 从 Session 中提取用户 ID
@@ -47,11 +48,28 @@ func hashSessionToken(token string) string {
 	return hex.EncodeToString(h.Sum(nil))
 }
 
-func setLoginSession(ctx context.Context, c *gin.Context, user *model.User) error {
+func rotateSessionID(s sessions.Session) {
+	if inner, ok := s.(interface{ Session() *gsessions.Session }); ok {
+		if sess := inner.Session(); sess != nil {
+			sess.ID = ""
+		}
+	}
+}
+
+// SetLoginSession writes the authenticated user into a freshly rotated session.
+func SetLoginSession(ctx context.Context, c *gin.Context, user *model.User, extras ...map[string]any) error {
 	session := sessions.Default(c)
+	session.Clear()
+	rotateSessionID(session)
+
 	session.Set(UserIDKey, user.ID)
 	session.Set(UserNameKey, user.Username)
 	session.Set(PasswordHashKey, user.Password)
+	if len(extras) > 0 {
+		for key, value := range extras[0] {
+			session.Set(key, value)
+		}
+	}
 
 	// 根据系统配置动态设置 Session 过期时间
 	maxAge := config.Config.App.SessionAge