feat: enhance OAuth flow validation and improve security checks; add credential read blocking and git operation safeguards

src/model/msglog/mod.rs

@@ -22,6 +22,8 @@ pub fn open_or_create(session_dir: &std::path::Path) -> anyhow::Result<rusqlite:
         std::fs::create_dir_all(parent)?;
     }
     let conn = rusqlite::Connection::open(&path)?;
+    conn.execute_batch("PRAGMA journal_mode = WAL;")?;
+    conn.execute_batch("PRAGMA busy_timeout = 5000;")?;
     schema::init_schema(&conn)?;
     Ok(conn)
 }

src/model/msglog/schema.rs

@@ -11,6 +11,7 @@ use anyhow::Result;
 ///
 /// Return: `Ok(())` on success, or the underlying SQLite error.
 pub fn init_schema(conn: &Connection) -> Result<()> {
+    conn.execute_batch("PRAGMA foreign_keys = ON;")?;
     conn.execute_batch(
         "
         CREATE TABLE IF NOT EXISTS messages (