feat(core): sync framework security hardening and accessibility improvements

- add util.Go with panic recovery for background goroutines
- add util.EscapeLike and explicit ESCAPE clause for SQL LIKE queries
- add DummyCheckPassword and subtle.ConstantTimeCompare against timing attacks
- enforce session ID rotation upon login/oauth callback to prevent session fixation
- add sliding window login failure rate limiting and oauth state rate limiting
- fix redis client capture race in pubsub listeners and wait on stop channel
- adjust global --primary to oklch(51.1% 0.262 276.966) for WCAG AA contrast
- fix semantic heading levels and missing aria-labels across UI components
- document security, concurrency, and a11y standards in AGENTS.md

internal/platform/lifecycle/lifecycle.go

@@ -8,6 +8,8 @@ import (
 	"context"
 	"log"
 	"sync"
+
+	"github.com/Rain-kl/Wavelet/pkg/util"
 )
 
 // ShutdownFunc defines the signature for a graceful shutdown callback.
@@ -40,7 +42,8 @@ func Stop(ctx context.Context) {
 	var wg sync.WaitGroup
 	for _, h := range localHooks {
 		wg.Add(1)
-		go func(name string, fn ShutdownFunc) {
+		name, fn := h.name, h.fn
+		util.Go(func() {
 			defer wg.Done()
 			log.Printf("[Lifecycle] stopping %s...\n", name)
 			if err := fn(ctx); err != nil {
@@ -48,14 +51,14 @@ func Stop(ctx context.Context) {
 			} else {
 				log.Printf("[Lifecycle] %s stopped successfully\n", name)
 			}
-		}(h.name, h.fn)
+		})
 	}
 
 	done := make(chan struct{})
-	go func() {
+	util.Go(func() {
 		wg.Wait()
 		close(done)
-	}()
+	})
 
 	select {
 	case <-done: