feat(core): sync framework security hardening and accessibility improvements

- add util.Go with panic recovery for background goroutines
- add util.EscapeLike and explicit ESCAPE clause for SQL LIKE queries
- add DummyCheckPassword and subtle.ConstantTimeCompare against timing attacks
- enforce session ID rotation upon login/oauth callback to prevent session fixation
- add sliding window login failure rate limiting and oauth state rate limiting
- fix redis client capture race in pubsub listeners and wait on stop channel
- adjust global --primary to oklch(51.1% 0.262 276.966) for WCAG AA contrast
- fix semantic heading levels and missing aria-labels across UI components
- document security, concurrency, and a11y standards in AGENTS.md

pkg/util/goroutine_test.go

@@ -0,0 +1,38 @@
+// Copyright 2026 Arctel.net
+// SPDX-License-Identifier: Apache-2.0
+
+package util
+
+import (
+	"sync"
+	"testing"
+)
+
+func TestGoRecoversPanic(t *testing.T) {
+	var wg sync.WaitGroup
+	wg.Add(1)
+
+	// Go should swallow the panic without crashing the test process
+	Go(func() {
+		defer wg.Done()
+		panic("boom")
+	})
+
+	wg.Wait()
+}
+
+func TestGoRunsNormally(t *testing.T) {
+	var wg sync.WaitGroup
+	wg.Add(1)
+	ran := false
+
+	Go(func() {
+		defer wg.Done()
+		ran = true
+	})
+
+	wg.Wait()
+	if !ran {
+		t.Fatal("expected fn to run")
+	}
+}