phase4-6: harden help/docs links and auth defaults

Close remaining low-priority review follow-ups by removing hardcoded help URLs, improving help drawer accessibility, raising explicit bcrypt cost, and adding validation/injection coverage; also bound postqueue reads with a timeout to avoid hangs.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Co-authored-by: Cursor <cursoragent@cursor.com>

internal/postfix/queue.go

@@ -1,12 +1,16 @@
 package postfix
 
 import (
+	"context"
 	"fmt"
 	"os/exec"
 	"regexp"
 	"strings"
+	"time"
 )
 
+const postqueueTimeout = 5 * time.Second
+
 // Queue returns Postfix's own human-readable mail-queue listing
 // (architecture.md § Panel HTTP surface): active, deferred and held messages,
 // exactly as an administrator would see via the CLI. The command takes a
@@ -14,8 +18,13 @@ import (
 // (security.md). The panel is responsible for escaping the output before
 // display (security.md); this function returns it as-is.
 func Queue() (string, error) {
-	cmd := exec.Command("postqueue", "-p")
+	ctx, cancel := context.WithTimeout(context.Background(), postqueueTimeout)
+	defer cancel()
+	cmd := exec.CommandContext(ctx, "postqueue", "-p")
 	out, err := cmd.CombinedOutput()
+	if ctx.Err() == context.DeadlineExceeded {
+		return "", fmt.Errorf("postqueue -p timed out after %s", postqueueTimeout)
+	}
 	if err != nil {
 		return "", fmt.Errorf("postqueue -p: %w: %s", err, strings.TrimSpace(string(out)))
 	}