feat(auth): reset a forgotten password by mail

"Passwort vergessen?" appears on the login screen when SMTP and BASE_URL
are configured. The request always gets the same answer and sends the mail
in the background (at most every 2 minutes per account). The link holds a
random token valid once for one hour; only its SHA-256 is stored. Setting
the new password invalidates all open links and ends every session. The
app removes the token from the address bar and offers a way back for
expired links.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

frontend/src/lib/api.ts

@@ -188,6 +188,15 @@ export const api = {
     return res;
   },
 
+  // Public: always the same answer, whether the address exists or not
+  async requestPasswordReset(email: string): Promise<void> {
+    await request('/api/v1/auth/forgot-password', { method: 'POST', body: JSON.stringify({ email }) });
+  },
+
+  async resetPassword(token: string, password: string): Promise<void> {
+    await request('/api/v1/auth/reset-password', { method: 'POST', body: JSON.stringify({ token, password }) });
+  },
+
   async login(loginOrEmail: string, password: string): Promise<{ token: string; user: User }> {
     const res = await request<{ token: string; user: User }>('/api/v1/auth/login', {
       method: 'POST',