CVE-2026-82410: PocketBase Unhandled Panic in Worker Goroutines

PocketBase's panic-recovery middleware is scoped to the HTTP request handler chain only. Internal child goroutines (cron workers, realtime subscription workers, backup tasks, and similar background jobs) run outside that scope.

Any unhandled panic in one of those goroutines propagates all the way to the Go runtime with no deferred recover() in the call stack, terminating the server process immediately. An attacker who can craft a request that triggers a code path running inside such a worker can take the server down entirely.