Password recovery

Generate a secure reset link

Email sending is not wired yet, so the reset link is surfaced in-app for development and testing.