feat(auth): reset a forgotten password from an emailed link (milestone 497)

Step #5429 "Reset by email: request, link and new-password page" of
milestone 497 "Passwords: change your own, and reset it by email".

- Sign-in page: "Forgot your password?" while a mail server is set.
- /forgot takes a username or email and answers the same either way; only
  an active local account with a real address gets mail. Requests count
  per address on their own throttle, so they never lock out sign-in.
- password_resets (migration 0039): a one-time key, stored as its sha256,
  working for an hour; asking again replaces it.
- /reset/<key>: the new password, then signed straight in; every other
  browser is signed out (sessions_since). Bad keys count as invite keys do.
- Email "[Steward] Reset your password", in the account's own zone.
- Audited: user.password_reset_requested, user.password_reset_by_email.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

steward/templates/auth/forgot.html

@@ -0,0 +1,30 @@
+{# auth/forgot.html — ask for a password-reset email (milestone 497). It answers
+   the same whether or not an account matched. #}
+{% extends "base.html" %}
+{% block title %}Forgot your password — Steward{% endblock %}
+{% block content %}
+<div class="invite-page">
+  <div class="card">
+    <h1 class="invite-title">Forgot your password?</h1>
+    {% if error %}<div class="alert alert-error" role="alert">{{ error }}</div>{% endif %}
+    {% if sent %}
+    <div class="alert alert-success" role="status">If that names a Steward account with a password and an email address, a link to choose a new password is on its way to that address. It works for an hour.</div>
+    <a href="/login" class="btn btn-ghost">Back to sign in</a>
+    {% elif not mail_ready %}
+    <p class="invite-lede">Steward has no mail server set, so it can't email you a link. Ask an admin to set a new password for you in Settings › Users.</p>
+    <a href="/login" class="btn btn-ghost">Back to sign in</a>
+    {% else %}
+    <p class="invite-lede">Enter your username or email address. If your account has a Steward password, we'll email you a link to choose a new one.</p>
+    <form method="post" action="/forgot">{{ csrf_field() }}
+      <div class="field">
+        <label class="field-label" for="forgot-name">Username or email</label>
+        <input class="input" id="forgot-name" type="text" name="name" maxlength="255" required autofocus autocomplete="username">
+        <span class="field-hint">Accounts that sign in with LDAP or single sign-on change their password there.</span>
+      </div>
+      <button type="submit" class="btn invite-submit">Email me a link</button>
+    </form>
+    <p class="field-hint"><a href="/login">Back to sign in</a></p>
+    {% endif %}
+  </div>
+</div>
+{% endblock %}

steward/templates/auth/login.html

@@ -32,6 +32,9 @@
               Sign In
             </button>
         </form>
+        {% if reset_by_email() %}
+        <p class="login-forgot"><a href="/forgot">Forgot your password?</a></p>
+        {% endif %}
     </div>
 </div>
 {% endblock %}

steward/templates/auth/reset.html

@@ -0,0 +1,32 @@
+{# auth/reset.html — choose a new password from an emailed link (milestone 497).
+   `username` is set while the link works; otherwise only `error` shows. #}
+{% extends "base.html" %}
+{% block title %}Choose a new password — Steward{% endblock %}
+{% block content %}
+<div class="invite-page">
+  <div class="card">
+    <h1 class="invite-title">Choose a new password</h1>
+    {% if username %}
+    <p class="invite-lede">For <strong>{{ username }}</strong>. Once it's set you're signed in here, and signed out anywhere else.</p>
+    {% endif %}
+    {% if error %}<div class="alert alert-error" role="alert">{{ error }}</div>{% endif %}
+    {% if username %}
+    <form method="post" action="/reset/{{ key }}">{{ csrf_field() }}
+      <input type="text" name="username" value="{{ username }}" autocomplete="username" hidden>
+      <div class="field">
+        <label class="field-label" for="reset-pw">New password</label>
+        <input class="input" id="reset-pw" type="password" name="password" minlength="{{ min_password }}" required autofocus autocomplete="new-password">
+        <span class="field-hint">At least {{ min_password }} characters.</span>
+      </div>
+      <div class="field">
+        <label class="field-label" for="reset-pw2">New password again</label>
+        <input class="input" id="reset-pw2" type="password" name="confirm" required autocomplete="new-password">
+      </div>
+      <button type="submit" class="btn invite-submit">Set password and sign in</button>
+    </form>
+    {% else %}
+    <a href="/forgot" class="btn btn-ghost">Ask for a new link</a>
+    {% endif %}
+  </div>
+</div>
+{% endblock %}