Reset your password

Next step (when you’re ready): wire this to SMTP + a password_reset_tokens table so it’s fully automated. For now this page is the professional entry point and avoids leaking whether an email exists.