feat(auth): reset a forgotten password from an emailed link (milestone 497)

Step #5429 "Reset by email: request, link and new-password page" of
milestone 497 "Passwords: change your own, and reset it by email".

- Sign-in page: "Forgot your password?" while a mail server is set.
- /forgot takes a username or email and answers the same either way; only
  an active local account with a real address gets mail. Requests count
  per address on their own throttle, so they never lock out sign-in.
- password_resets (migration 0039): a one-time key, stored as its sha256,
  working for an hour; asking again replaces it.
- /reset/<key>: the new password, then signed straight in; every other
  browser is signed out (sessions_since). Bad keys count as invite keys do.
- Email "[Steward] Reset your password", in the account's own zone.
- Audited: user.password_reset_requested, user.password_reset_by_email.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

steward/core/mail.py

@@ -271,6 +271,15 @@ ROLE_WORDS = {
 }
 
 
+def reset_email(username: str, expires_at: datetime, url: str, tz: tzinfo) -> tuple[str, str, str]:
+    """(subject, text, html) for a password-reset link (milestone 497): whose
+    account, when the link stops working (in the account's own zone) and the
+    link, with what to do if they didn't ask."""
+    facts = {"username": username, "link": url, "expires": moment(expires_at, tz)}
+    text, html = _render("password_reset", r=facts)
+    return "[Steward] Reset your password", text, html
+
+
 def invite_email(inviter: str, role: str, expires_at: datetime, url: str,
                  tz: tzinfo) -> tuple[str, str, str]:
     """(subject, text, html) for an invite (milestone 496): who sent it, the