feat: seed script, forgot-password, hover cards, shortcuts, OpenAPI docs, runbook (phase 12)

- scripts/seed.go: idempotent demo data per §11.11 (make seed)
- forgot/reset password: SMTP-gated, one-shot TTL tokens, uniform responses
  against enumeration, sessions revoked on reset; login page link + pages
- profile hover cards on [data-user-card] elements (§11.13)
- keyboard shortcuts: g b/m/t/h navigation, / focuses search (§10)
- bulk archive endpoint (§11.9)
- hand-written OpenAPI 3.1 covering §6, served at /api/docs + yaml download
- make backup / make restore (mongodump archive via the mongo container)
- README: quick start, demo data, runbook, breaker/job operations, working
  Caddy + nginx reverse-proxy samples (WS block, client_max_body_size),
  documented later-stubs (§11.24)
- smoke.sh now exercises register → logout → login → me → board → pages

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

Makefile

@@ -29,14 +29,20 @@ lint:
 		echo "gofmt needed on:"; echo "$$unformatted"; exit 1; fi
 	$(GO) vet ./...
 
+# Requires Mongo published on loopback (test overlay) or MONGO_SEED_URI.
 seed:
-	@echo "seed script lands in phase 12 (scripts/seed.go)"; exit 1
+	$(GO) run ./scripts
 
 smoke:
 	./scripts/smoke.sh
 
+# mongodump/mongorestore through the mongo container into ./backups (§11.23)
 backup:
-	@echo "backup target lands in phase 12"; exit 1
+	@mkdir -p backups
+	docker compose exec -T mongo mongodump --archive --db=bountyboard > backups/bountyboard-$$(date +%Y%m%d-%H%M%S).archive
+	@ls -lh backups/ | tail -1
 
+# usage: make restore FILE=backups/bountyboard-20260612-120000.archive
 restore:
-	@echo "restore target lands in phase 12"; exit 1
+	@test -n "$(FILE)" || (echo "usage: make restore FILE=backups/<archive>"; exit 1)
+	docker compose exec -T mongo mongorestore --archive --drop < $(FILE)