phase4-6: harden help/docs links and auth defaults

Close remaining low-priority review follow-ups by removing hardcoded help URLs, improving help drawer accessibility, raising explicit bcrypt cost, and adding validation/injection coverage; also bound postqueue reads with a timeout to avoid hangs.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Co-authored-by: Cursor <cursoragent@cursor.com>

internal/web/handlers/handlers_settings.go

@@ -191,7 +191,7 @@ func (h *Handlers) submitSettings(w http.ResponseWriter, r *http.Request) {
 
 	hash := user.PasswordHash
 	if repassword {
-		newHash, err := bcrypt.GenerateFromPassword([]byte(password), bcrypt.DefaultCost)
+		newHash, err := bcrypt.GenerateFromPassword([]byte(password), bcryptCost)
 		if err != nil {
 			logf("panel: settings: hashing password failed: %v", err)
 			h.renderSettings(w, r, http.StatusInternalServerError,

internal/web/handlers/handlers_users.go

@@ -171,7 +171,7 @@ func (h *Handlers) submitUserCreate(w http.ResponseWriter, r *http.Request) {
 		return
 	}
 
-	hash, err := bcrypt.GenerateFromPassword([]byte(password), bcrypt.DefaultCost)
+	hash, err := bcrypt.GenerateFromPassword([]byte(password), bcryptCost)
 	if err != nil {
 		logf("panel: create user hash: %v", err)
 		h.renderUserForm(w, r, http.StatusInternalServerError, 0, userFormView{FormErr: "Internal error. Please try again."})
@@ -240,7 +240,7 @@ func (h *Handlers) submitUserUpdate(w http.ResponseWriter, r *http.Request, u st
 			h.renderUserForm(w, r, http.StatusBadRequest, u.ID, userFormView{FormErr: err.Error(), FormUsername: username, FormRole: string(role), FormDomains: selected})
 			return
 		}
-		newHash, err := bcrypt.GenerateFromPassword([]byte(password), bcrypt.DefaultCost)
+		newHash, err := bcrypt.GenerateFromPassword([]byte(password), bcryptCost)
 		if err != nil {
 			logf("panel: update user hash: %v", err)
 			h.renderUserForm(w, r, http.StatusInternalServerError, u.ID, userFormView{FormErr: "Internal error. Please try again.", FormUsername: username, FormRole: string(role), FormDomains: selected})

internal/web/handlers/password.go

@@ -0,0 +1,3 @@
+package handlers
+
+const bcryptCost = 12

internal/web/validate/validate_email_test.go

@@ -15,4 +15,19 @@ func TestValidateEmail(t *testing.T) {
 	if err := Email("x@gmail.com"); err == nil {
 		t.Error("gmail accepted")
 	}
+	if err := Email("reports+rua@mail.example.com"); err != nil {
+		t.Errorf("plus-address valid: %v", err)
+	}
+	if err := Email("bad space@mail.example.com"); err == nil {
+		t.Error("address with space accepted")
+	}
+	if err := Email("привет@mail.example.com"); err == nil {
+		t.Error("non-ascii local-part accepted")
+	}
+	if err := Email("x@-example.com"); err == nil {
+		t.Error("invalid domain accepted")
+	}
+	if err := Email("x@protonmail.com"); err == nil {
+		t.Error("blocked freemail domain accepted")
+	}
 }

internal/web/view/templates/help.html

@@ -32,7 +32,7 @@ on the card itself.</p>
   </ul>
   <p class="muted">Topics marked as labels open the same text in the help
   drawer. For installation, backup, and environment variables see the
-  <a href="https://github.com/mixeme/selfpost/blob/main/docs/guide.md">operator
+  <a href="{{.SourceURL}}/blob/main/docs/guide.md">operator
   guide</a> in the repository.</p>
 </div>
 

internal/web/view/templates/help_drawer.html

@@ -21,14 +21,14 @@
 {{end}}
 
 {{define "help_drawer"}}
-<label class="help-scrim" for="help-off"></label>
+<label class="help-scrim" for="help-off" role="button" aria-label="Close help"></label>
 <aside class="help-drawer">
-  <label class="help-close" for="help-off">Close</label>
+  <label class="help-close" for="help-off" role="button" aria-label="Close help">Close</label>
 
   <article class="help-pane help-pane-index">
     <h2>Help</h2>
     <p>Short notes for the card you opened — not a second copy of the
-    <a href="https://github.com/mixeme/selfpost/blob/main/docs/guide.md">operator guide</a>.</p>
+    <a href="{{.SourceURL}}/blob/main/docs/guide.md">operator guide</a>.</p>
     {{if .IsGlobal}}
     <p class="muted">Status</p>
     <ul class="toc"><li><label for="help-status">Status checks</label></li></ul>