feat: password reset via email

- Add password_resets table: single-use tokens with 1h expiry.
- Add POST /api/forgot-password: sends reset link if account exists and is verified (always returns ok to prevent enumeration).
- Add POST /api/reset-password: validates token, updates password, invalidates all open reset tokens for that user in one transaction.
- Add /reset-password page with password strength meter and confirm field.
- Add "Passwort vergessen?" flow on login page.
- Factor shared email template into mailer helper, add sendPasswordResetMail.
- Rate limits: 5 forgot-requests/hour per IP, 10 reset attempts/15min per IP.

index.js

@@ -43,6 +43,7 @@ app.get('/login', html('login.html'));
 app.get('/admin', html('admin.html'));
 app.get('/datenschutz', html('datenschutz.html'));
 app.get('/app', html('app.html'));
+app.get('/reset-password', html('reset-password.html'));
 app.get('/{*path}', html('index.html'));
 
 app.listen(PORT, '127.0.0.1', () => console.log(`info1 läuft auf :${PORT}`));