feat: seed script, forgot-password, hover cards, shortcuts, OpenAPI docs, runbook (phase 12)

- scripts/seed.go: idempotent demo data per §11.11 (make seed)
- forgot/reset password: SMTP-gated, one-shot TTL tokens, uniform responses
  against enumeration, sessions revoked on reset; login page link + pages
- profile hover cards on [data-user-card] elements (§11.13)
- keyboard shortcuts: g b/m/t/h navigation, / focuses search (§10)
- bulk archive endpoint (§11.9)
- hand-written OpenAPI 3.1 covering §6, served at /api/docs + yaml download
- make backup / make restore (mongodump archive via the mongo container)
- README: quick start, demo data, runbook, breaker/job operations, working
  Caddy + nginx reverse-proxy samples (WS block, client_max_body_size),
  documented later-stubs (§11.24)
- smoke.sh now exercises register → logout → login → me → board → pages

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

internal/http/auth.go

@@ -24,6 +24,79 @@ func (s *Server) routesAuth(mux *http.ServeMux) {
 	mux.Handle("GET /api/v1/auth/me", s.requireAuth(http.HandlerFunc(s.handleMe)))
 	mux.HandleFunc("GET /api/v1/auth/oidc/login", s.handleOIDCLogin)
 	mux.HandleFunc("GET /api/v1/auth/oidc/callback", s.handleOIDCCallback)
+	mux.HandleFunc("POST /api/v1/auth/forgot", s.handleForgotPassword)
+	mux.HandleFunc("POST /api/v1/auth/reset", s.handleResetPassword)
+}
+
+// handleForgotPassword issues a one-shot reset token by email (§11.22).
+// Active only when SMTP is configured; never reveals account existence.
+func (s *Server) handleForgotPassword(w http.ResponseWriter, r *http.Request) {
+	var req struct {
+		Email string `json:"email"`
+	}
+	if !decodeJSON(w, r, &req) {
+		return
+	}
+	if s.mailer == nil || !s.mailer.Enabled() {
+		writeError(w, http.StatusServiceUnavailable, "smtp_disabled",
+			"password reset by email is not configured on this server")
+		return
+	}
+	if !s.loginLimiter.Allow("forgot|" + ClientIP(r.Context()).String()) {
+		writeError(w, http.StatusTooManyRequests, "rate_limited", "too many attempts")
+		return
+	}
+	u, err := s.store.UserByEmail(r.Context(), req.Email)
+	if err == nil && u.Auth.Local != nil && !u.Disabled {
+		token := auth.NewToken()
+		if err := s.store.CreatePasswordReset(r.Context(), token, u.ID, time.Hour); err != nil {
+			s.internalError(w, r, "create reset", err)
+			return
+		}
+		link := s.cfg.AppBaseURL + "/reset-password?token=" + token
+		go func() {
+			if err := s.mailer.Send(u.Email, "Reset your Bounty Board password",
+				"Use this link within one hour to set a new password:\n\n"+link+
+					"\n\nIf you did not request this, ignore this email."); err != nil {
+				s.log.Error("send reset mail", "err", err)
+			}
+		}()
+	}
+	// uniform response regardless of account existence
+	writeJSON(w, http.StatusOK, map[string]string{"status": "sent_if_account_exists"})
+}
+
+func (s *Server) handleResetPassword(w http.ResponseWriter, r *http.Request) {
+	var req struct {
+		Token       string `json:"token"`
+		NewPassword string `json:"newPassword"`
+	}
+	if !decodeJSON(w, r, &req) {
+		return
+	}
+	if len(req.NewPassword) < auth.MinPasswordLen {
+		writeError(w, http.StatusBadRequest, "weak_password",
+			fmt.Sprintf("password must be at least %d characters", auth.MinPasswordLen))
+		return
+	}
+	userID, err := s.store.ConsumePasswordReset(r.Context(), req.Token)
+	if err != nil {
+		writeError(w, http.StatusBadRequest, "invalid_token", "this reset link is invalid or expired")
+		return
+	}
+	hash, err := auth.HashPassword(req.NewPassword)
+	if err != nil {
+		s.internalError(w, r, "hash password", err)
+		return
+	}
+	if err := s.store.SetPassword(r.Context(), userID, hash, false); err != nil {
+		s.internalError(w, r, "set password", err)
+		return
+	}
+	if _, err := s.store.DeleteUserSessions(r.Context(), userID); err != nil {
+		s.log.Warn("revoke sessions after reset", "err", err)
+	}
+	w.WriteHeader(http.StatusNoContent)
 }
 
 // decodeJSON reads a bounded JSON body into dst, rejecting unknown fields.