Adds "Passwort vergessen?" to login page with email-based password
reset flow. Backend generates secure token (SHA-256 hashed, 1h expiry),
sends reset link via SMTP, and validates on submission. Includes rate
limiting (3 requests/hour/email), audit logging, and account unlock
on successful reset. New ResetPasswordPage with password confirmation.
New DB table: password_reset_tokens (migration 008).
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
