Claus Lohmar 6f2ea67503 fix(security): deliver /access notifications off the request path ... REVIEW-001 (M0) M2s: POST /access was a timing oracle — a hit did two synchronous SMTP sends, a miss one SELECT, so "is this email on record?" leaked (A3). Dispatch the notification through a Deps.Dispatch seam (default `go fn()`), detached from the request context (context.WithoutCancel, so audit values survive) and bounded by a 30s timeout. Tests inject a synchronous runner where they assert no-spam semantics, and a new test asserts the default is asynchronous with a blocking mailer. A panic in the detached goroutine is recovered: net/http no longer guards it, and a notification must never take the process down.		2026-10-14 11:30:01 +00:00
..
core	fix(security): deliver /access notifications off the request path	2026-10-14 11:30:01 +00:00
modules	feat(module): add the module registry, discovery and the home module (SPEC-008)	2026-10-14 10:53:57 +00:00