Add missing password-reset frontend pages

Commit notes

The password-reset emails link to /auth/reset-password on the frontend, but no such page existed (the frontend UI is Google-OAuth-only while the backend fully supports local accounts), so every reset link was a dead 404.

- /auth/reset-password: consumes the emailed token, new password + confirmation form, handles missing/expired tokens. - /auth/forgot-password: enumeration-safe request form (mirrors the backend's identical-response behavior) and the re-request target for expired links. - API client: requestPasswordReset / resetPassword via Eden.

[private session redacted]