Password reset

This flow now creates a one-time reset token without leaking whether the email exists. In local development, the reset link is shown as a preview instead of being mailed.