feat(core): sync framework security hardening and accessibility improvements

- add util.Go with panic recovery for background goroutines
- add util.EscapeLike and explicit ESCAPE clause for SQL LIKE queries
- add DummyCheckPassword and subtle.ConstantTimeCompare against timing attacks
- enforce session ID rotation upon login/oauth callback to prevent session fixation
- add sliding window login failure rate limiting and oauth state rate limiting
- fix redis client capture race in pubsub listeners and wait on stop channel
- adjust global --primary to oklch(51.1% 0.262 276.966) for WCAG AA contrast
- fix semantic heading levels and missing aria-labels across UI components
- document security, concurrency, and a11y standards in AGENTS.md

internal/apps/upload/cache/access_cache.go

@@ -17,6 +17,7 @@ import (
 	"github.com/Rain-kl/Wavelet/internal/infra/persistence"
 	"github.com/Rain-kl/Wavelet/internal/model"
 	"github.com/Rain-kl/Wavelet/internal/repository"
+	"github.com/Rain-kl/Wavelet/pkg/util"
 )
 
 const fileAccessInvalidationChannel = "upload:file_access_invalidation"
@@ -56,7 +57,7 @@ func startAccessCacheInvalidationListener() {
 		return
 	}
 
-	go func() {
+	util.Go(func() {
 		pubsub := db.Redis.Subscribe(
 			context.Background(),
 			objectstore.ConfigInvalidationChannel,
@@ -69,7 +70,7 @@ func startAccessCacheInvalidationListener() {
 		for range pubsub.Channel() {
 			ResetAccessCaches()
 		}
-	}()
+	})
 }
 
 // IsFilePublic reports whether uploadType is in the public access whitelist.