password reset: an admin makes a one-hour link, and using it signs the account out everywhere

There is no mail path, so a forgotten password needed a hand on the database
(#2939 §2). Settings → People lists the accounts; Reset password makes a link
that works once within an hour, shown once for the admin to hand over. Making
another link for the same account closes the earlier one.

Using it (/reset-password) sets the password, deletes the account's device
tokens, and moves users.session_epoch on. Sessions are signed cookies the
server can't delete, so each now carries the epoch it signed in under and
login_required reads the account's epoch by primary key. A cookie from before
this has no epoch and reads as 0, the starting value, so the upgrade signs
nobody out. A deleted account's session now stops working too.

The one-time link reveal moves out of InviteList into OneTimeLink, and the
link-building into router/links.ts, shared by invites and resets.

Migration 0033. #5173.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

frontend/src/components/InviteList.vue

@@ -1,12 +1,12 @@
 <script setup lang="ts">
 import { onMounted, ref } from "vue";
-import { useRouter } from "vue-router";
 import { api } from "../api/client";
 import { errorMessage } from "../api/errors";
 import { useUiStore } from "../stores/ui";
+import { appLink } from "../router/links";
 import BaseButton from "./BaseButton.vue";
 import BaseInput from "./BaseInput.vue";
-import Icon from "./Icon.vue";
+import OneTimeLink from "./OneTimeLink.vue";
 
 // Admin: invite one person to register while registration stays closed (#5172).
 // The server keeps only a hash of each invite's token, so the link is shown once,
@@ -29,7 +29,6 @@ const LIFETIMES = [
   { days: 30, label: "30 days" },
 ];
 
-const router = useRouter();
 const ui = useUiStore();
 
 const invites = ref<Invite[]>([]);
@@ -52,12 +51,6 @@ async function load() {
   }
 }
 
-/** The register page's address with the token on it, as people reach this server. */
-function linkFor(token: string): string {
-  const path = router.resolve({ name: "register", query: { invite: token } }).href;
-  return new URL(path, window.location.origin).href;
-}
-
 async function create() {
   creating.value = true;
   error.value = "";
@@ -67,7 +60,7 @@ async function create() {
       email: email.value.trim() || null,
       days: days.value,
     });
-    freshLink.value = linkFor(res.token);
+    freshLink.value = appLink({ name: "register", query: { invite: res.token } });
     invites.value = [res.invite, ...invites.value];
     email.value = "";
   } catch (e) {
@@ -77,15 +70,6 @@ async function create() {
   }
 }
 
-async function copyLink() {
-  try {
-    await navigator.clipboard.writeText(freshLink.value);
-    ui.showToast("Invite link copied.");
-  } catch {
-    ui.showToast("Couldn't copy — select and copy it manually.");
-  }
-}
-
 async function revoke(invite: Invite) {
   if (!window.confirm(`Revoke the invite for ${who(invite)}? Its link will stop working.`)) return;
   try {
@@ -127,31 +111,12 @@ onMounted(() => {
   <section class="flex flex-col gap-5">
     <h2 class="text-xs font-semibold uppercase tracking-wide text-neutral-400">Invites</h2>
 
-    <!-- One-time link reveal -->
-    <div
+    <OneTimeLink
       v-if="freshLink"
-      class="rounded-xl border border-brand/40 bg-brand/5 p-4 dark:border-brand/30 dark:bg-brand/10"
-    >
-      <p class="text-sm font-medium text-neutral-800 dark:text-neutral-100">
-        Copy this link now — it won't be shown again.
-      </p>
-      <div class="mt-2 flex items-center gap-2">
-        <code
-          class="min-w-0 flex-1 overflow-x-auto rounded-lg border border-neutral-300 bg-white px-3 py-2 font-mono text-xs text-neutral-900 dark:border-neutral-700 dark:bg-neutral-900 dark:text-neutral-100"
-          >{{ freshLink }}</code
-        >
-        <button type="button" class="icon-btn shrink-0" title="Copy link" aria-label="Copy link" @click="copyLink">
-          <Icon name="copy" />
-        </button>
-      </div>
-      <button
-        type="button"
-        class="mt-3 text-xs text-neutral-500 underline hover:text-neutral-700 dark:hover:text-neutral-300"
-        @click="freshLink = ''"
-      >
-        Done
-      </button>
-    </div>
+      :link="freshLink"
+      note="Send this to the person you're inviting."
+      @done="freshLink = ''"
+    />
 
     <form class="flex flex-wrap items-end gap-3" @submit.prevent="create">
       <BaseInput