feat: add secure password reset and admin recovery links

[droxer]

Summary

Add forgotten-password recovery by username or email, plus an admin-generated reset-link fallback when mail is unavailable.

Sign in → Forgot password → Email reset link
                          → Choose password → Revoke sessions → Sign in
Admin → Create reset link ────────────┘

• Store only hashed, expiring, single-use tokens in either auth store; issuing another link retires older ones.
• Keep public responses uniform, throttle requests, use configured email-link origins, and notify the owner after a password change.
• Serialize file-auth writes and database issuance/redemption; allow retry after transient browser lookup errors.

Evidence

• Before: Concurrent file writes restored old passwords/sessions; PostgreSQL redemption held reset rows while waiting for the Account; transient lookup failures had no retry.
  After: Regression tests pass, including the real PostgreSQL concurrency test, which fails with the original method substituted in memory.
• Full backend suite: 2,908 passed, 1 skipped.
• React suite: 535 passed. TypeScript compilation, five reset utility tests, production web build, and git diff --check passed.
• npm audit on this branch reports 11 existing high-severity findings in frontend tooling dependencies; no dependency files changed. Main already addresses these in fix: patch braces stack-exhaustion DoS (CVE-2026-93687) #451.

Merge Danger

Door: two-way

Apply Alembic migration 20261016_0097 before deploying the backend. Self-serve reset requires mail configuration and RELAY_PUBLIC_WEB_URL or RELAY_PUBLIC_BACKEND_URL; admin-issued links work without mail. Completion revokes Account sessions and requires a fresh sign-in. Partial mail configuration now fails startup even with the waitlist disabled.

Blast Radius: authentication

Affects both auth stores, login/recovery pages, admin user editing, and the shared transactional mailer. Daemon credentials are unaffected.