Password reset

Password reset by email requires SMTP credentials and a configured mail transport. This starter build intentionally does not send reset links until SMTP is configured, to avoid pretending an email was sent.