feat(core): sync framework security hardening and accessibility improvements

- add util.Go with panic recovery for background goroutines
- add util.EscapeLike and explicit ESCAPE clause for SQL LIKE queries
- add DummyCheckPassword and subtle.ConstantTimeCompare against timing attacks
- enforce session ID rotation upon login/oauth callback to prevent session fixation
- add sliding window login failure rate limiting and oauth state rate limiting
- fix redis client capture race in pubsub listeners and wait on stop channel
- adjust global --primary to oklch(51.1% 0.262 276.966) for WCAG AA contrast
- fix semantic heading levels and missing aria-labels across UI components
- document security, concurrency, and a11y standards in AGENTS.md

internal/apps/upload/cache/meta_cache.go

@@ -12,6 +12,7 @@ import (
 	"github.com/Rain-kl/Wavelet/internal/infra/persistence"
 	"github.com/Rain-kl/Wavelet/internal/model"
 	"github.com/Rain-kl/Wavelet/pkg/cache/ram"
+	"github.com/Rain-kl/Wavelet/pkg/util"
 )
 
 const (
@@ -29,6 +30,7 @@ var (
 	uploadMetaListenerOnce   sync.Once
 	uploadMetaListenerCtx    context.Context
 	uploadMetaListenerCancel context.CancelFunc
+	uploadMetaListenerDone   chan struct{}
 )
 
 func uploadMetaRedisKey(id uint64) string {
@@ -48,17 +50,20 @@ func ensureUploadMetaCacheListener() {
 
 func startUploadMetaCacheInvalidationListener() {
 	uploadMetaListenerCtx, uploadMetaListenerCancel = context.WithCancel(context.Background())
+	uploadMetaListenerDone = make(chan struct{})
 
-	go func() {
-		pubsub := db.Redis.Subscribe(uploadMetaListenerCtx, uploadMetaInvalidationChan)
+	redisClient := db.Redis // 捕获当前客户端：goroutine 不读可变全局，避免与测试置空 db.Redis 竞争
+	util.Go(func() {
+		defer close(uploadMetaListenerDone)
+		pubsub := redisClient.Subscribe(uploadMetaListenerCtx, uploadMetaInvalidationChan)
 		defer func() {
 			_ = pubsub.Close()
 		}()
 
-		go func() {
+		util.Go(func() {
 			<-uploadMetaListenerCtx.Done()
 			_ = pubsub.Close()
-		}()
+		})
 
 		for msg := range pubsub.Channel() {
 			var payload uploadMetaInvalidationMessage
@@ -68,7 +73,7 @@ func startUploadMetaCacheInvalidationListener() {
 			}
 			uploadMetaRAM.Invalidate(payload.ID)
 		}
-	}()
+	})
 }
 
 func publishUploadMetaRAMInvalidation(ctx context.Context, id uint64) {
@@ -145,7 +150,11 @@ func ResetUploadMetaCacheForTest() {
 func StopUploadMetaCacheListener() {
 	if uploadMetaListenerCancel != nil {
 		uploadMetaListenerCancel()
+		if uploadMetaListenerDone != nil {
+			<-uploadMetaListenerDone // 等待 goroutine 退出，保证之后置空 db.Redis 不再竞争
+		}
 		uploadMetaListenerCancel = nil
+		uploadMetaListenerDone = nil
 	}
 	uploadMetaListenerOnce = sync.Once{}
 }