**Description:** Allow users to reset their password using the token from the reset email. **Tasks:** - [ ] Create `PATCH /api/auth/reset-password/:token` - [ ] Validate the token against the stored hash and check expiry - [ ] Hash the new password and update the user document - [ ] Invalidate the reset token and all existing refresh tokens **Acceptance Criteria:** Valid token resets password; expired/invalid token returns `400`. ---
Description:
Allow users to reset their password using the token from the reset email.
Tasks:
PATCH /api/auth/reset-password/:tokenAcceptance Criteria:
Valid token resets password; expired/invalid token returns
400.