Fix password reset token collision

[flemzord]

What changed

• Disable the automatic Rails password reset token generated by has_secure_password.
• Keep the existing JDH database-backed reset token workflow and its 24-hour validity period.
• Add an end-to-end controller test that requests a reset, decodes the delivered email, follows the link, changes the password, and verifies authentication.
• Add coverage for two successive reset requests, ensuring only the latest link remains valid.

Root cause

Rails 8.1 automatically defines password_reset_token through has_secure_password. JDH already has a database column with the same name. The generated Rails method masked the stored attribute: the application saved its legacy token in the database but rendered a different signed Rails token in the email. The controller then attempted an exact database lookup with that signed token, which could never match.

User impact

Password reset links sent by email work again. A newer reset request continues to invalidate previous links.

Validation

• 451 RSpec examples, 0 failures.
• standardrb passes.
• The regression tests failed before the fix and pass after it.