password reset by email: Settings → Email, Forgot password?, and a test-email button

The operator asked for self-service reset over SMTP. It reuses #5173's
password_resets table, /reset-password page, one-hour single-use token and
sign-out-everywhere.

- Settings (rule 25, not env): a new Email group (SMTP server, port,
  encryption as a choice, username, password, from), General → Public
  address, and Security → Reset emails per account. The registry gains
  `choices`, `secret` (the value is never sent back, `is_set` says one is
  saved, an empty save keeps it) and `url` (http(s), trailing slash
  stripped).
- mailer.py: stdlib smtplib on a worker thread, 20 s timeout,
  starttls | tls | none. mail_settings() is None until a server, a sender
  and the public address are set. Links are built from the public address
  because the Host header can be forged.
- POST /api/auth/forgot-password: the same answer at the same speed for
  any address. The link is made and mailed off the request (send_later).
  It is throttled like a sign-in per visitor address, and capped per typed
  email by reset_emails_per_account; past the cap it answers the same and
  sends nothing.
- POST /api/settings/test-email: mails the admin with the saved settings
  and shows the server's error if it fails.
- Public config `password_reset_by_email`. Sign-in shows "Forgot
  password?" only then, linking to a new /forgot-password page.
- docs/public-hosting.md: an "Email and forgotten passwords" section.

Tests: the secret stays server-side; emailed link → reset; the same
answer for unknown addresses; the cap; test email success and failure;
validation units. #5266.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

docs/public-hosting.md

@@ -108,15 +108,37 @@ docker run --rm -v inkwell-data:/d -v "$PWD":/out alpine tar czf /out/media.tgz
 - **Session cookies are `HttpOnly` and `SameSite=Lax`**, which is also what stands in
   for CSRF protection: a `Lax` cookie is not sent on a cross-site POST.
 
+## Email and forgotten passwords
+
+A forgotten password can be reset two ways. Either way the link works once, within
+an hour, and using it signs the account out everywhere and unlinks its apps.
+
+- **By an admin, always.** Settings → People → Reset password makes a link, and the
+  admin hands it over.
+- **By the person, once email is set up.** Fill in Settings → Email (SMTP server,
+  port, encryption, sign-in and a from address) and Settings → General → Public
+  address, the URL people reach this server at. Save, then press **Send test email**,
+  which mails you with exactly the settings a reset will use. From then on the sign-in
+  screen offers **Forgot password?**
+
+The public address is required because the emailed link has to point somewhere the
+server can trust. Built from the request instead, a forged `Host` header would mail
+someone a reset link to a site the forger controls.
+
+The SMTP password is kept in the database and never sent back to the browser; the
+field shows only that one is saved. The forgot-password page answers the same way,
+at the same speed, whether or not an address has an account, and
+`reset_emails_per_account` (Settings → Security) caps how many reset emails one
+address can be sent.
+
 ## What it does not do
 
 Know these before you decide who gets an account.
 
-- **No email at all.** `email_verified` exists on the user row and nothing sets it.
-  A forgotten password is reset by an admin: Settings → People → Reset password makes
-  a link that works once, within an hour, and the admin hands it over. Using it signs
-  the account out everywhere and unlinks its apps. An admin who forgets their own
-  password and has no other admin still needs a hand on the database.
+- **No email verification.** `email_verified` exists on the user row and nothing sets
+  it. Email is used only for password resets (above).
+- **An admin who forgets their own password**, with email off and no other admin,
+  still needs a hand on the database.
 - **No second factor.** A password is the whole of it.
 - **No per-user storage quota.** Any account can upload attachments until the volume
   is full. `max_attachment_mb` caps a single file, not a total.