AUTH-003: Password reset — forgot password and reset via email link

## Overview
Allow users to reset their password via a time-limited email link.

## Acceptance Criteria
- [ ] 'Forgot password?' link on the login page
- [ ] Email input collects the address; a reset link is sent if the account exists
- [ ] Reset link is valid for 1 hour and single-use
- [ ] New password meets complexity requirements
- [ ] User is redirected to login after successful reset

## Depends On
- #37 (AUTH-001 — session management infrastructure)

Start by reviewing #37 for the session-management infrastructure, then locate the login page and existing account or email-related entry points. Implement the listed forgot-password flow, including the one-hour single-use link, password requirements, and redirect to login, and verify each acceptance criterion.

Written by the indexing model from the issue text.