feat: seed script, forgot-password, hover cards, shortcuts, OpenAPI docs, runbook (phase 12)

- scripts/seed.go: idempotent demo data per §11.11 (make seed)
- forgot/reset password: SMTP-gated, one-shot TTL tokens, uniform responses
  against enumeration, sessions revoked on reset; login page link + pages
- profile hover cards on [data-user-card] elements (§11.13)
- keyboard shortcuts: g b/m/t/h navigation, / focuses search (§10)
- bulk archive endpoint (§11.9)
- hand-written OpenAPI 3.1 covering §6, served at /api/docs + yaml download
- make backup / make restore (mongodump archive via the mongo container)
- README: quick start, demo data, runbook, breaker/job operations, working
  Caddy + nginx reverse-proxy samples (WS block, client_max_body_size),
  documented later-stubs (§11.24)
- smoke.sh now exercises register → logout → login → me → board → pages

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

internal/http/server.go

@@ -28,6 +28,7 @@ type Server struct {
 	files        *files.Store
 	templates    map[string]*template.Template
 	oidc         *auth.OIDCClient
+	mailer       *auth.Mailer
 	loginLimiter *auth.RateLimiter
 	checks       []ReadinessCheck
 	startedAt    time.Time
@@ -72,6 +73,7 @@ func New(cfg *config.Config, log *slog.Logger, reg *metrics.Registry, st *store.
 		files:        fs,
 		templates:    templates,
 		oidc:         auth.NewOIDCClient(cfg, log),
+		mailer:       auth.NewMailer(cfg.SMTP),
 		loginLimiter: auth.NewRateLimiter(10, 15*time.Minute),
 		startedAt:    time.Now(),
 	}
@@ -89,6 +91,7 @@ func New(cfg *config.Config, log *slog.Logger, reg *metrics.Registry, st *store.
 	s.routesWorkResults(mux)
 	s.routesMessages(mux)
 	s.routesMetrics(mux)
+	s.routesDocs(mux)
 	mux.HandleFunc("GET /ws", s.handleWS)
 	s.routesWeb(mux)