**Description:** Allow users to request a password reset via email. **Tasks:** - [ ] Create `POST /api/auth/forgot-password` - [ ] Find user by email (always return `200` to avoid user enumeration) - [ ] Generate a secure reset token and save its hash + expiry to the user document - [ ] Send password reset email with the token link **Acceptance Criteria:** An email with a reset link is sent if the email exists in the system. ---
Description:
Allow users to request a password reset via email.
Tasks:
POST /api/auth/forgot-password200to avoid user enumeration)Acceptance Criteria:
An email with a reset link is sent if the email exists in the system.