[Demo][Security] Replace weak reset token generator

## Demo goal
Show a second security remediation path from finding to fix PR.

## Problem
`/api/password-reset-token` uses `Math.random()` token generation.

## Requested change
- Use cryptographically secure token generation
- Increase entropy and return expiry metadata
- Add clear error handling for missing email

## Presenter cue
Use this as the follow-up issue after XSS to show prioritization and MTTR reduction.

## Files
- `demo-app/server.js`