Password reset

The forgot/reset password flow uses hashed one-time reset tokens:

1. POST /forgot-password — answers identically for known and unknown emails (no user enumeration); the reset email is only sent when the account exists.
2. createPasswordReset(email) generates a 256-bit token, stores its hash with a 60-minute expiry, and emails a link: <APP_URL>/reset-password?email=...&token=...
3. POST /reset-password — verifies the token + email, validates the password confirmation, updates the hash, clears pending resets, and redirects to /login?notice=password_reset.

Mail drivers

Selected via MAIL_DRIVER:

Driver	Notes
log	Prints a formatted message + records it in sentMails (assertable in tests). Default.
resend	Requires RESEND_API_KEY.
mailtrap	Requires MAILTRAP_API_TOKEN; add MAILTRAP_INBOX_ID for the sandbox endpoint.

Zero dependencies — plain fetch against the provider APIs.