prd: Add Forgot Password Functionality

**Is your feature request related to a problem? Please describe.**
Users who forget their password currently have no self-service way to regain access to their account. They must either remember their existing password or rely on an administrator to manually reset it. This can create unnecessary friction and support overhead, especially for self-hosted deployments with multiple users.

**Describe the solution you'd like**
Add a standard password reset workflow to the open-source version of Label Studio.

The workflow would include:

A "Forgot Password?" link on the login page.
A page where users can enter their email address.
Generation of a secure, time-limited password reset token.
Delivery of a password reset link via the configured email backend.
A page allowing users to set a new password after validating the token.

The feature should leverage existing Django authentication and email infrastructure where possible.

**Describe alternatives you've considered**
Manual password resets performed by administrators.
Direct database updates to change user passwords.
Using external authentication providers (SSO/OAuth) to avoid password management entirely.

**Additional context**
Potential security considerations:

Tokens should be cryptographically secure and expire after a configurable duration.
Password reset requests should not reveal whether an email address exists in the system.
Rate limiting may be considered to prevent abuse.

Start by tracing the existing Django authentication flow, login page, and configured email backend. Define the forgot-password request, secure time-limited token, reset-link delivery, token validation, and new-password pages. Done should include non-disclosing responses for unknown emails, token expiry, and the security considerations described in the issue.

Written by the indexing model from the issue text.