User Management UI — password reset flow

[victorsoriadrp]

Context

Self-hosted deployments using local auth (non-OIDC) have no password reset flow. A user who forgets their password requires admin DB intervention.

Acceptance criteria

• "Forgot password" link on login screen (only visible when local auth is enabled)
• Backend: time-limited reset token, single use
• Email delivery via the same hook as invitations (User Management UI — workspace invitations #87)
• Reset flow lands on a password update screen
• Old session tokens invalidated after successful reset
• Audit log entry auth.password_reset

Related

• Part of User Management UI work for v0.7 (User Management UI — workspace invitations #87, User Management UI — role assignment #89)