feat(core): sync framework security hardening and accessibility improvements

- add util.Go with panic recovery for background goroutines
- add util.EscapeLike and explicit ESCAPE clause for SQL LIKE queries
- add DummyCheckPassword and subtle.ConstantTimeCompare against timing attacks
- enforce session ID rotation upon login/oauth callback to prevent session fixation
- add sliding window login failure rate limiting and oauth state rate limiting
- fix redis client capture race in pubsub listeners and wait on stop channel
- adjust global --primary to oklch(51.1% 0.262 276.966) for WCAG AA contrast
- fix semantic heading levels and missing aria-labels across UI components
- document security, concurrency, and a11y standards in AGENTS.md

pkg/push/email.go

@@ -10,6 +10,8 @@ import (
 	"net"
 	"net/smtp"
 	"strings"
+
+	"github.com/Rain-kl/Wavelet/pkg/util"
 )
 
 func init() {
@@ -86,9 +88,9 @@ func (p *EmailPusher) Send(ctx context.Context, cfg Config, target string, body
 
 	// 异步超时处理
 	errChan := make(chan error, 1)
-	go func() {
+	util.Go(func() {
 		errChan <- smtp.SendMail(host+":"+port, auth, from, []string{to}, msg)
-	}()
+	})
 
 	select {
 	case <-ctx.Done():

pkg/util/goroutine.go

@@ -0,0 +1,31 @@
+// Copyright 2026 Arctel.net
+// SPDX-License-Identifier: Apache-2.0
+
+package util
+
+import (
+	"log/slog"
+	"runtime"
+	"runtime/debug"
+)
+
+// Go runs fn in a new goroutine and recovers panics, so a background task
+// cannot crash the whole process. The panic is logged together with the
+// util.Go call site. Use it for every fire-and-forget / long-lived
+// background goroutine; HTTP handlers are already covered by gin.Recovery.
+func Go(fn func()) {
+	pc, file, line, _ := runtime.Caller(1)
+	go func() {
+		defer func() {
+			if r := recover(); r != nil {
+				slog.Error("panic recovered in background goroutine",
+					"caller", runtime.FuncForPC(pc).Name(),
+					"file", file,
+					"line", line,
+					"panic", r,
+					"stack", string(debug.Stack()))
+			}
+		}()
+		fn()
+	}()
+}

pkg/util/goroutine_test.go

@@ -0,0 +1,38 @@
+// Copyright 2026 Arctel.net
+// SPDX-License-Identifier: Apache-2.0
+
+package util
+
+import (
+	"sync"
+	"testing"
+)
+
+func TestGoRecoversPanic(t *testing.T) {
+	var wg sync.WaitGroup
+	wg.Add(1)
+
+	// Go should swallow the panic without crashing the test process
+	Go(func() {
+		defer wg.Done()
+		panic("boom")
+	})
+
+	wg.Wait()
+}
+
+func TestGoRunsNormally(t *testing.T) {
+	var wg sync.WaitGroup
+	wg.Add(1)
+	ran := false
+
+	Go(func() {
+		defer wg.Done()
+		ran = true
+	})
+
+	wg.Wait()
+	if !ran {
+		t.Fatal("expected fn to run")
+	}
+}

pkg/util/like.go

@@ -0,0 +1,16 @@
+// Copyright 2026 Arctel.net
+// SPDX-License-Identifier: Apache-2.0
+
+package util
+
+import "strings"
+
+var likeEscaper = strings.NewReplacer(`\`, `\\`, `%`, `\%`, `_`, `\_`)
+
+// EscapeLike escapes SQL LIKE metacharacters (\, %, _) so a user-supplied
+// value matches literally in LIKE patterns. Pair it with an explicit
+// `ESCAPE '\'` clause where the dialect has no backslash default (SQLite);
+// PostgreSQL and ClickHouse treat backslash as the default LIKE escape.
+func EscapeLike(value string) string {
+	return likeEscaper.Replace(value)
+}

pkg/util/like_test.go

@@ -0,0 +1,22 @@
+// Copyright 2026 Arctel.net
+// SPDX-License-Identifier: Apache-2.0
+
+package util
+
+import "testing"
+
+func TestEscapeLike(t *testing.T) {
+	cases := map[string]string{
+		"":            "",
+		"/my_page":    `/my\_page`,
+		"100%":        `100\%`,
+		`a\b`:         `a\\b`,
+		`%_\`:         `\%\_\\`,
+		"normal/path": "normal/path",
+	}
+	for input, want := range cases {
+		if got := EscapeLike(input); got != want {
+			t.Errorf("EscapeLike(%q) = %q, want %q", input, got, want)
+		}
+	}
+}

pkg/util/password.go

@@ -3,7 +3,11 @@
 
 package util
 
-import "golang.org/x/crypto/bcrypt"
+import (
+	"sync"
+
+	"golang.org/x/crypto/bcrypt"
+)
 
 // HashPassword 使用 bcrypt 对密码进行哈希处理
 func HashPassword(password string) (string, error) {
@@ -14,7 +18,31 @@ func HashPassword(password string) (string, error) {
 	return string(hash), nil
 }
 
+var dummyPasswordHashOnce sync.Once
+var dummyPasswordHash string
+
+func dummyHash() string {
+	dummyPasswordHashOnce.Do(func() {
+		hash, err := bcrypt.GenerateFromPassword([]byte("x"), bcrypt.DefaultCost)
+		if err != nil {
+			return
+		}
+		dummyPasswordHash = string(hash)
+	})
+	return dummyPasswordHash
+}
+
 // CheckPasswordHash 比较 bcrypt 哈希值与明文密码是否匹配
 func CheckPasswordHash(hash, password string) bool {
 	return bcrypt.CompareHashAndPassword([]byte(hash), []byte(password)) == nil
 }
+
+// DummyCheckPassword runs a bcrypt compare against a dummy hash so missing-user
+// login failures take a similar amount of time as a real password miss.
+func DummyCheckPassword(password string) {
+	hash := dummyHash()
+	if hash == "" {
+		return
+	}
+	_ = CheckPasswordHash(hash, password)
+}

pkg/util/password_test.go

@@ -0,0 +1,23 @@
+// Copyright 2026 Arctel.net
+// SPDX-License-Identifier: Apache-2.0
+
+package util
+
+import "testing"
+
+func TestDummyCheckPasswordDoesNotPanic(t *testing.T) {
+	DummyCheckPassword("any-password")
+}
+
+func TestCheckPasswordHashRoundTrip(t *testing.T) {
+	hash, err := HashPassword("secret-pass")
+	if err != nil {
+		t.Fatal(err)
+	}
+	if !CheckPasswordHash(hash, "secret-pass") {
+		t.Fatal("expected matching password to succeed")
+	}
+	if CheckPasswordHash(hash, "other-pass") {
+		t.Fatal("expected mismatched password to fail")
+	}
+}