[AUTH-003] Auth: Password reset & forgot password flow

## Overview
Allow users to reset their password via a time-limited email link.

## Acceptance Criteria
- [ ] "Forgot Password" link on login modal
- [ ] `POST /api/auth/forgot-password` sends reset email (always returns 200 to prevent enumeration)
- [ ] Reset link expires after 1 hour
- [ ] `POST /api/auth/reset-password` validates token and sets new password
- [ ] All active sessions invalidated after password reset
- [ ] Confirmation screen after successful reset

## Security Notes
- Tokens must be cryptographically random (not guessable)
- One-time use only — invalidate token immediately after use

## Depends On
- #5 AUTH-001 — requires user lookup and session invalidation logic