fix(auth): build password-reset links from an operator-set public address, never the Host header (M462 #4981)

buildResetURL used r.Host and r.TLS, so a forgot-password request with a
forged Host emailed the victim a real reset token on a link to the
attacker's server. Links now come only from network_settings.public_url
(migration 0062), and no reset email is sent while it is empty; the response
stays the same opaque 200 and the log says why.

The address is set on a new "Public address" card under Admin → Integrations,
which offers the page's own origin and warns while unset. PUT
/api/admin/network-settings takes either field alone, so the proxy card and
this one can't overwrite each other.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

web/src/routes/admin/integrations/+page.svelte

@@ -28,6 +28,7 @@
   import { pushToast } from '$lib/stores/toast.svelte';
   import Modal from '$lib/components/Modal.svelte';
   import NetworkSettingsCard from '$lib/components/NetworkSettingsCard.svelte';
+  import PublicAddressCard from '$lib/components/PublicAddressCard.svelte';
   import type { LidarrConfig, LidarrTestResult } from '$lib/api/types';
 
   // Lidarr connection panel. The "saved api key" is masked as "***" on GET —
@@ -827,6 +828,7 @@
        other card on this page, and it's an operator-wide setting rather than
        a per-user preference. -->
   <NetworkSettingsCard />
+  <PublicAddressCard />
 </div>
 
 <Modal