Minor improvements in the UX of forgot password

# Problem

Here are some brief ideas on how to improve the UX of the forgot password feature, from a conversation with @snewcomer:

## Ideas
- [ ] tell the user when that email isn’t registered
- [ ] allow it to be reset by username or email (similar to existing issue to allow login by either)
- [ ] `/password/reset` could redirect to `/password/forgot` if there were no code supplied, with an error message
- [ ] `/password/reset` could redirect to `/password/forgot` if the code were expired, with an error message
- [ ] `/password/reset` could show the success message on that page itself, and then have a button to “continue to sign in” (which then does the auto-authentication)

Start by tracing the existing /password/forgot and /password/reset flows in the JavaScript application. Review how missing or expired codes, unregistered emails, username-or-email lookup, and successful resets are currently handled. Done should be defined by selecting and implementing a specific subset of these UX ideas, with tests covering each chosen flow.

Vom Indexierungsmodell aus dem Issue-Text verfasst.