Feature: Implement Real "Forgot Password" Email Flow with Token Verification

#### 📄 Description

The current **Forgot Password** page (`/forgot-password`) only simulates the reset flow but does **not send any real email**. This issue is to implement a working password reset system using a backend email sender (e.g., Nodemailer) and token-based authentication.

This will apply only to **credential-based users** (users who signed up using email and password). OAuth-based users (e.g., Google login) should be excluded from this flow, with a proper UI message.

---

#### ✅ Goals

- Verify if the entered email exists in the database.
- If valid:
- Generate a secure, unique token (e.g., UUID or JWT).
- Store the token temporarily (in a `password_resets` table or memory store).
- Send an email using **Nodemailer** with a reset link that includes the token as a query param.
- Example: `https://simplifai-ai.vercel.app/reset-password?token=abc123`
- Create a `/reset-password` page:
- Read token from URL query.
- Verify the token's validity.
- Allow the user to enter and submit a new password.
- Update the user's password using **Prisma**.
- Show success/failure messages accordingly.

---

#### 📌 Tasks

- [ ] Create `/api/send-reset` API route:
- [ ] Accept email and verify if the user exists.
- [ ] Generate a secure token and store it.
- [ ] Send the email using Nodemailer with the reset link.
- [ ] Connect the frontend form (`ForgotPasswordPage.tsx`) to call `/api/send-reset`.
- [ ] Create the `/reset-password` page:
- [ ] Read the token from the URL.
- [ ] Verify the token server-side.
- [ ] Show a form to enter a new password.
- [ ] Update the user's password using Prisma.
- [ ] Add toast messages for success, error, and loading states.
- [ ] Add a loading state to the "Send Reset Link" button.
- [ ] Handle edge cases (invalid email, expired/invalid token, etc.).

---

#### 🔐 Security Considerations

- Use time-limited tokens (e.g., 15–30 min expiration).
- Invalidate the token after successful password reset.
- Optionally store hashed tokens for added security.
- Rate limit the reset request endpoint to prevent abuse.

---

#### 🧪 Example API Flow

```ts
// POST /api/send-reset
{
email: "user@example.com"
}

// Email contains:
https://simplifai-ai.vercel.app/reset-password?token=abc123