Request reset

Verified users can request a short-lived reset token.

Password reset flow

• request uses email verification
• development mode exposes the reset token for local testing
• successful reset invalidates existing sessions