feat: seed script, forgot-password, hover cards, shortcuts, OpenAPI docs, runbook (phase 12)

- scripts/seed.go: idempotent demo data per §11.11 (make seed)
- forgot/reset password: SMTP-gated, one-shot TTL tokens, uniform responses
  against enumeration, sessions revoked on reset; login page link + pages
- profile hover cards on [data-user-card] elements (§11.13)
- keyboard shortcuts: g b/m/t/h navigation, / focuses search (§10)
- bulk archive endpoint (§11.9)
- hand-written OpenAPI 3.1 covering §6, served at /api/docs + yaml download
- make backup / make restore (mongodump archive via the mongo container)
- README: quick start, demo data, runbook, breaker/job operations, working
  Caddy + nginx reverse-proxy samples (WS block, client_max_body_size),
  documented later-stubs (§11.24)
- smoke.sh now exercises register → logout → login → me → board → pages

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

internal/auth/mail.go

@@ -0,0 +1,43 @@
+package auth
+
+import (
+	"fmt"
+	"net/smtp"
+	"strings"
+
+	"bountyboard/internal/config"
+)
+
+// Mailer sends plain-text email via SMTP (net/smtp, STARTTLS when offered).
+// All features depending on it stay disabled until SMTP_HOST is set (§7).
+type Mailer struct {
+	cfg config.SMTP
+}
+
+func NewMailer(cfg config.SMTP) *Mailer { return &Mailer{cfg: cfg} }
+
+func (m *Mailer) Enabled() bool { return m.cfg.Enabled() }
+
+func (m *Mailer) Send(to, subject, body string) error {
+	if !m.Enabled() {
+		return fmt.Errorf("smtp is not configured")
+	}
+	addr := fmt.Sprintf("%s:%d", m.cfg.Host, m.cfg.Port)
+	msg := strings.Join([]string{
+		"From: " + m.cfg.From,
+		"To: " + to,
+		"Subject: " + subject,
+		"MIME-Version: 1.0",
+		"Content-Type: text/plain; charset=utf-8",
+		"",
+		body,
+	}, "\r\n")
+	var a smtp.Auth
+	if m.cfg.User != "" {
+		a = smtp.PlainAuth("", m.cfg.User, m.cfg.Password, m.cfg.Host)
+	}
+	if err := smtp.SendMail(addr, a, m.cfg.From, []string{to}, []byte(msg)); err != nil {
+		return fmt.Errorf("smtp send: %w", err)
+	}
+	return nil
+}