feat(auth): reset a forgotten password by mail

"Passwort vergessen?" appears on the login screen when SMTP and BASE_URL
are configured. The request always gets the same answer and sends the mail
in the background (at most every 2 minutes per account). The link holds a
random token valid once for one hour; only its SHA-256 is stored. Setting
the new password invalidates all open links and ends every session. The
app removes the token from the address bar and offers a way back for
expired links.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

internal/config/config.go

@@ -15,6 +15,9 @@ type Config struct {
 	DatabasePath      string
 	JWTSecret         string
 	BaseURL           string
+	// BaseURLSet: BASE_URL was configured explicitly. Links in mails (password reset) are only built
+	// from it, never from the request's Host header.
+	BaseURLSet bool
 	AllowRegistration bool
 	LogLevel          string
 	Debug             bool
@@ -153,6 +156,7 @@ func Load() *Config {
 		DatabasePath:      dbPath,
 		JWTSecret:         jwtSecret,
 		BaseURL:           baseURL,
+		BaseURLSet:        strings.TrimSpace(os.Getenv("BASE_URL")) != "",
 		AllowRegistration: allowReg,
 		LogLevel:          logLevel,
 		Debug:             debug,