feat(core): sync framework security hardening and accessibility improvements

- add util.Go with panic recovery for background goroutines
- add util.EscapeLike and explicit ESCAPE clause for SQL LIKE queries
- add DummyCheckPassword and subtle.ConstantTimeCompare against timing attacks
- enforce session ID rotation upon login/oauth callback to prevent session fixation
- add sliding window login failure rate limiting and oauth state rate limiting
- fix redis client capture race in pubsub listeners and wait on stop channel
- adjust global --primary to oklch(51.1% 0.262 276.966) for WCAG AA contrast
- fix semantic heading levels and missing aria-labels across UI components
- document security, concurrency, and a11y standards in AGENTS.md

internal/apps/user/errs.go

@@ -44,4 +44,5 @@ const (
 	errParseEmailPayloadFailed      = "解析邮件发送参数失败: %w"
 	errSMTPConfigIncomplete         = "系统 SMTP 邮件服务配置不完整"
 	errSendMailFailed               = "发送邮件失败: %w"
+	errLoginRateLimited             = "请求过于频繁，请稍后再试"
 )