Add email-based password reset flow

Users who forget their password can now request a reset link via email.
Tokens are SHA-256 hashed before storage, expire after 1 hour, and
previous unused tokens are invalidated on new requests. The forgot-password
endpoint always returns success to prevent email enumeration.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

src/fabledassistant/config.py

@@ -37,3 +37,4 @@ class Config:
     SMTP_FROM_ADDRESS: str = os.environ.get("SMTP_FROM_ADDRESS", "")
     SMTP_FROM_NAME: str = os.environ.get("SMTP_FROM_NAME", "Fabled Assistant")
     SMTP_USE_TLS: bool = os.environ.get("SMTP_USE_TLS", "true").lower() in ("1", "true", "yes")
+    BASE_URL: str = os.environ.get("BASE_URL", "http://localhost:5000").rstrip("/")