phase4-6: harden help/docs links and auth defaults

Close remaining low-priority review follow-ups by removing hardcoded help URLs, improving help drawer accessibility, raising explicit bcrypt cost, and adding validation/injection coverage; also bound postqueue reads with a timeout to avoid hangs.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Co-authored-by: Cursor <cursoragent@cursor.com>

internal/web/validate/validate_email_test.go

@@ -15,4 +15,19 @@ func TestValidateEmail(t *testing.T) {
 	if err := Email("x@gmail.com"); err == nil {
 		t.Error("gmail accepted")
 	}
+	if err := Email("reports+rua@mail.example.com"); err != nil {
+		t.Errorf("plus-address valid: %v", err)
+	}
+	if err := Email("bad space@mail.example.com"); err == nil {
+		t.Error("address with space accepted")
+	}
+	if err := Email("привет@mail.example.com"); err == nil {
+		t.Error("non-ascii local-part accepted")
+	}
+	if err := Email("x@-example.com"); err == nil {
+		t.Error("invalid domain accepted")
+	}
+	if err := Email("x@protonmail.com"); err == nil {
+		t.Error("blocked freemail domain accepted")
+	}
 }