feat(auth): 'Forgot password' request endpoint and form

[ebouchut]

"Forgot password" request: endpoint + Thymeleaf form.

• Generate a high-entropy random token; store its hash in reset_tokens with expires_at and requester ip_address.
• Send the reset email with a link /reset?token=<raw>.
• Enumeration-safe response regardless of whether the email exists.
• Record an audit_logs entry.