password reset by email: Settings → Email, Forgot password?, and a test-email button

The operator asked for self-service reset over SMTP. It reuses #5173's
password_resets table, /reset-password page, one-hour single-use token and
sign-out-everywhere.

- Settings (rule 25, not env): a new Email group (SMTP server, port,
  encryption as a choice, username, password, from), General → Public
  address, and Security → Reset emails per account. The registry gains
  `choices`, `secret` (the value is never sent back, `is_set` says one is
  saved, an empty save keeps it) and `url` (http(s), trailing slash
  stripped).
- mailer.py: stdlib smtplib on a worker thread, 20 s timeout,
  starttls | tls | none. mail_settings() is None until a server, a sender
  and the public address are set. Links are built from the public address
  because the Host header can be forged.
- POST /api/auth/forgot-password: the same answer at the same speed for
  any address. The link is made and mailed off the request (send_later).
  It is throttled like a sign-in per visitor address, and capped per typed
  email by reset_emails_per_account; past the cap it answers the same and
  sends nothing.
- POST /api/settings/test-email: mails the admin with the saved settings
  and shows the server's error if it fails.
- Public config `password_reset_by_email`. Sign-in shows "Forgot
  password?" only then, linking to a new /forgot-password page.
- docs/public-hosting.md: an "Email and forgotten passwords" section.

Tests: the secret stays server-side; emailed link → reset; the same
answer for unknown addresses; the cap; test email success and failure;
validation units. #5266.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

frontend/src/stores/config.ts

@@ -43,6 +43,9 @@ export interface PublicConfig {
   enable_url_unfurl: boolean;
   // How many days a note survives in Trash before the server purges it. 0 = forever.
   trash_retention_days: number;
+  // Whether this server can email a reset link, so sign-in offers "Forgot password?"
+  // (#5266). Absent on an older server and on the offline desktop: no.
+  password_reset_by_email?: boolean;
   // Every client this server holds, keyed by platform id. Absent on a server that
   // holds none, and absent on the desktop's own offline config — the Tauri build
   // answers `config_get` locally and has no clients to hand out.
@@ -66,6 +69,7 @@ export const useConfigStore = defineStore("config", () => {
   // Empty until proven otherwise: a server with no clients, and an older server
   // that never had the field, both correctly offer no downloads.
   const clients = ref<Record<string, ClientRelease>>({});
+  const passwordResetByEmail = ref(false);
   const loaded = ref(false);
 
   async function load(): Promise<void> {
@@ -78,6 +82,7 @@ export const useConfigStore = defineStore("config", () => {
       enableUrlUnfurl.value = cfg.enable_url_unfurl ?? true;
       trashRetentionDays.value = cfg.trash_retention_days ?? 30;
       clients.value = cfg.clients ?? {};
+      passwordResetByEmail.value = cfg.password_reset_by_email ?? false;
     } catch {
       // Keep defaults if the config endpoint is unreachable.
     } finally {
@@ -97,6 +102,7 @@ export const useConfigStore = defineStore("config", () => {
     enableUrlUnfurl,
     trashRetentionDays,
     clients,
+    passwordResetByEmail,
     loaded,
     load,
     reload,