feat(auth): reset a forgotten password by mail

"Passwort vergessen?" appears on the login screen when SMTP and BASE_URL
are configured. The request always gets the same answer and sends the mail
in the background (at most every 2 minutes per account). The link holds a
random token valid once for one hour; only its SHA-256 is stored. Setting
the new password invalidates all open links and ends every session. The
app removes the token from the address bar and offers a way back for
expired links.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

internal/storage/sqlite.go

@@ -514,6 +514,9 @@ func (s *Store) migrate() error {
 	}
 	s.migrateAnchorTags()
 	s.migrateSearchFTS()
+	if err := s.migratePasswordReset(); err != nil {
+		return err
+	}
 
 	_, err := s.db.Exec(fmt.Sprintf(`PRAGMA user_version = %d`, schemaVersion))
 	return err