feat(core): sync framework security hardening and accessibility improvements

- add util.Go with panic recovery for background goroutines
- add util.EscapeLike and explicit ESCAPE clause for SQL LIKE queries
- add DummyCheckPassword and subtle.ConstantTimeCompare against timing attacks
- enforce session ID rotation upon login/oauth callback to prevent session fixation
- add sliding window login failure rate limiting and oauth state rate limiting
- fix redis client capture race in pubsub listeners and wait on stop channel
- adjust global --primary to oklch(51.1% 0.262 276.966) for WCAG AA contrast
- fix semantic heading levels and missing aria-labels across UI components
- document security, concurrency, and a11y standards in AGENTS.md

pkg/util/goroutine.go

@@ -0,0 +1,31 @@
+// Copyright 2026 Arctel.net
+// SPDX-License-Identifier: Apache-2.0
+
+package util
+
+import (
+	"log/slog"
+	"runtime"
+	"runtime/debug"
+)
+
+// Go runs fn in a new goroutine and recovers panics, so a background task
+// cannot crash the whole process. The panic is logged together with the
+// util.Go call site. Use it for every fire-and-forget / long-lived
+// background goroutine; HTTP handlers are already covered by gin.Recovery.
+func Go(fn func()) {
+	pc, file, line, _ := runtime.Caller(1)
+	go func() {
+		defer func() {
+			if r := recover(); r != nil {
+				slog.Error("panic recovered in background goroutine",
+					"caller", runtime.FuncForPC(pc).Name(),
+					"file", file,
+					"line", line,
+					"panic", r,
+					"stack", string(debug.Stack()))
+			}
+		}()
+		fn()
+	}()
+}