New user: Set password process

When a new user is created via the Create User endpoint, the new user should receive an email with a link that allows them to set the password. After the user sets their password, they should be redirected to the login screen for Comrad.

Tasks:
- [ ] When a new user is created, send an email to them using the SMTP credentials in the environment file. The email should have a link where the user can set their password.
- [ ] This link should be set up as such so users couldn't guess the URL. For example, I shouldn't be able to go to http://localhost/set-password?user=seankwilliams@yahoo.com to set the password for seankwilliams@yahoo.com The link should use a token that cannot be associated with a username from the information available on the front-end.
- [ ] The Set Password page should set the password for the user. Passwords should have a minimum length of eight characters and have three out of the following: lowercase letters, uppercase letters, numbers, symbols/special characters.
- [ ] After the user submits the Set Password page, they should be redirected to the login page of Comrad.
- [ ] After the user submits the Set Password page, the link to set the user's password that was emailed out should no longer work. If a user clicks on this link, a message should be displayed to the user saying "This link is no longer valid."

Start by locating the Create User endpoint and the Set Password page, then inspect how environment-based SMTP credentials are configured. Trace the full account-activation flow, including token generation, password validation, redirect behavior, and link invalidation. Done means all listed steps work securely from invitation through login.

Written by the indexing model from the issue text.