Password recovery

Forgot your password?

The reset flow now mirrors the requirements document with request, OTP verification, and new-password steps instead of leaving recovery undefined.