Add password reset flow with email-based token verification
Implement secure password reset functionality:
- Add password_reset_tokens table for storing hashed reset tokens
- Create email utility module (dev mode logs to console)
- Add API endpoints: request, validate, and complete password reset
- Add web routes and templates for forgot-password and reset-password
- Security: 1-hour token expiry, single-use, rate limiting, session invalidation
- Prevent email enumeration by always returning success message
Co-Authored-By: Claude Opus 4.5 <[email protected]>
robandClaude Opus 4.5
05a2fae94c