feat(core): sync framework security hardening and accessibility improvements

- add util.Go with panic recovery for background goroutines
- add util.EscapeLike and explicit ESCAPE clause for SQL LIKE queries
- add DummyCheckPassword and subtle.ConstantTimeCompare against timing attacks
- enforce session ID rotation upon login/oauth callback to prevent session fixation
- add sliding window login failure rate limiting and oauth state rate limiting
- fix redis client capture race in pubsub listeners and wait on stop channel
- adjust global --primary to oklch(51.1% 0.262 276.966) for WCAG AA contrast
- fix semantic heading levels and missing aria-labels across UI components
- document security, concurrency, and a11y standards in AGENTS.md

pkg/push/email.go

@@ -10,6 +10,8 @@ import (
 	"net"
 	"net/smtp"
 	"strings"
+
+	"github.com/Rain-kl/Wavelet/pkg/util"
 )
 
 func init() {
@@ -86,9 +88,9 @@ func (p *EmailPusher) Send(ctx context.Context, cfg Config, target string, body
 
 	// 异步超时处理
 	errChan := make(chan error, 1)
-	go func() {
+	util.Go(func() {
 		errChan <- smtp.SendMail(host+":"+port, auth, from, []string{to}, msg)
-	}()
+	})
 
 	select {
 	case <-ctx.Done():