feat(auth): reset a forgotten password from an emailed link (milestone 497)

Step #5429 "Reset by email: request, link and new-password page" of
milestone 497 "Passwords: change your own, and reset it by email".

- Sign-in page: "Forgot your password?" while a mail server is set.
- /forgot takes a username or email and answers the same either way; only
  an active local account with a real address gets mail. Requests count
  per address on their own throttle, so they never lock out sign-in.
- password_resets (migration 0039): a one-time key, stored as its sha256,
  working for an hour; asking again replaces it.
- /reset/<key>: the new password, then signed straight in; every other
  browser is signed out (sessions_since). Bad keys count as invite keys do.
- Email "[Steward] Reset your password", in the account's own zone.
- Audited: user.password_reset_requested, user.password_reset_by_email.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

steward/templates/auth/forgot.html

@@ -0,0 +1,30 @@
+{# auth/forgot.html — ask for a password-reset email (milestone 497). It answers
+   the same whether or not an account matched. #}
+{% extends "base.html" %}
+{% block title %}Forgot your password — Steward{% endblock %}
+{% block content %}
+<div class="invite-page">
+  <div class="card">
+    <h1 class="invite-title">Forgot your password?</h1>
+    {% if error %}<div class="alert alert-error" role="alert">{{ error }}</div>{% endif %}
+    {% if sent %}
+    <div class="alert alert-success" role="status">If that names a Steward account with a password and an email address, a link to choose a new password is on its way to that address. It works for an hour.</div>
+    <a href="/login" class="btn btn-ghost">Back to sign in</a>
+    {% elif not mail_ready %}
+    <p class="invite-lede">Steward has no mail server set, so it can't email you a link. Ask an admin to set a new password for you in Settings › Users.</p>
+    <a href="/login" class="btn btn-ghost">Back to sign in</a>
+    {% else %}
+    <p class="invite-lede">Enter your username or email address. If your account has a Steward password, we'll email you a link to choose a new one.</p>
+    <form method="post" action="/forgot">{{ csrf_field() }}
+      <div class="field">
+        <label class="field-label" for="forgot-name">Username or email</label>
+        <input class="input" id="forgot-name" type="text" name="name" maxlength="255" required autofocus autocomplete="username">
+        <span class="field-hint">Accounts that sign in with LDAP or single sign-on change their password there.</span>
+      </div>
+      <button type="submit" class="btn invite-submit">Email me a link</button>
+    </form>
+    <p class="field-hint"><a href="/login">Back to sign in</a></p>
+    {% endif %}
+  </div>
+</div>
+{% endblock %}

steward/templates/auth/login.html

@@ -32,6 +32,9 @@
               Sign In
             </button>
         </form>
+        {% if reset_by_email() %}
+        <p class="login-forgot"><a href="/forgot">Forgot your password?</a></p>
+        {% endif %}
     </div>
 </div>
 {% endblock %}

steward/templates/auth/reset.html

@@ -0,0 +1,32 @@
+{# auth/reset.html — choose a new password from an emailed link (milestone 497).
+   `username` is set while the link works; otherwise only `error` shows. #}
+{% extends "base.html" %}
+{% block title %}Choose a new password — Steward{% endblock %}
+{% block content %}
+<div class="invite-page">
+  <div class="card">
+    <h1 class="invite-title">Choose a new password</h1>
+    {% if username %}
+    <p class="invite-lede">For <strong>{{ username }}</strong>. Once it's set you're signed in here, and signed out anywhere else.</p>
+    {% endif %}
+    {% if error %}<div class="alert alert-error" role="alert">{{ error }}</div>{% endif %}
+    {% if username %}
+    <form method="post" action="/reset/{{ key }}">{{ csrf_field() }}
+      <input type="text" name="username" value="{{ username }}" autocomplete="username" hidden>
+      <div class="field">
+        <label class="field-label" for="reset-pw">New password</label>
+        <input class="input" id="reset-pw" type="password" name="password" minlength="{{ min_password }}" required autofocus autocomplete="new-password">
+        <span class="field-hint">At least {{ min_password }} characters.</span>
+      </div>
+      <div class="field">
+        <label class="field-label" for="reset-pw2">New password again</label>
+        <input class="input" id="reset-pw2" type="password" name="confirm" required autocomplete="new-password">
+      </div>
+      <button type="submit" class="btn invite-submit">Set password and sign in</button>
+    </form>
+    {% else %}
+    <a href="/forgot" class="btn btn-ghost">Ask for a new link</a>
+    {% endif %}
+  </div>
+</div>
+{% endblock %}

steward/templates/email/password_reset.html

@@ -0,0 +1,19 @@
+{# A password-reset email's HTML part (milestone 497): r = the facts mail.reset_email builds. #}
+{% extends "_layout.html" %}
+{% from "_parts.html" import button, fact with context %}
+{% block title %}Reset your Steward password{% endblock %}
+{% block body %}
+<tr><td style="padding:10px 24px 4px 24px;font:600 20px/1.35 {{ c.font }};color:{{ c.text }};">Reset your Steward password</td></tr>
+<tr><td style="padding:6px 24px 4px 24px;font:14px/1.55 {{ c.font }};color:{{ c.text }};">Someone asked to reset the password for {{ r.username }}. Open the link to choose a new one. Anywhere you're signed in now, you'll be signed out.</td></tr>
+<tr><td style="padding:10px 24px 4px 24px;">
+<table role="presentation" width="100%" cellpadding="0" cellspacing="0" border="0">
+{{ fact("Account", r.username) }}
+{{ fact("Link works until", r.expires) }}
+</table>
+</td></tr>
+<tr><td style="padding:16px 24px 8px 24px;">{{ button(r.link, "Choose a new password") }}</td></tr>
+<tr><td style="padding:4px 24px 20px 24px;font:12px/1.5 {{ c.font }};color:{{ c.muted }};word-break:break-all;">Or paste this into your browser: {{ r.link }}</td></tr>
+{% endblock %}
+{% block footer %}
+The link works once. If you didn't ask for this, ignore it: your password is unchanged.
+{% endblock %}

steward/templates/email/password_reset.txt

@@ -0,0 +1,13 @@
+{# A password-reset email's plain-text part; the same facts as password_reset.html. #}
+Someone asked to reset the Steward password for {{ r.username }}.
+
+Open the link to choose a new password. Anywhere you're signed in now, you'll
+be signed out.
+
+Link works until: {{ r.expires }}
+
+Choose a new password: {{ r.link }}
+
+--
+The link works once. If you didn't ask for this, ignore it: your password is
+unchanged.