feat: add password reset ("forgot password") flow

Add a self-service password reset to the login flow:

- Login page now shows a "Passwort vergessen?" link under the password field
- New /forgot-password page requests a reset email by address
- New /reset-password page sets a new password from an emailed token
- Backend: POST /auth/forgot-password and /auth/reset-password with
  dedicated rate limiters; tokens stored as SHA-256 hashes with a 1h expiry
- Generic responses avoid leaking account existence or SMTP/SSO state;
  SSO-only accounts are skipped
- New sendPasswordResetEmail mailer + email/auth i18n keys (de + en)
- DB migration: reset_token_hash, reset_token_expires, reset_requested_at

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

src/pages/Login.jsx

@@ -220,6 +220,11 @@ export default function Login() {
                       required
                     />
                   </div>
+                  <div className="mt-1.5 text-right">
+                    <Link to="/forgot-password" className="text-sm text-th-accent hover:underline">
+                      {t('auth.forgotPassword')}
+                    </Link>
+                  </div>
                 </div>
 
                 <button