feat: seed script, forgot-password, hover cards, shortcuts, OpenAPI docs, runbook (phase 12)

- scripts/seed.go: idempotent demo data per §11.11 (make seed)
- forgot/reset password: SMTP-gated, one-shot TTL tokens, uniform responses
  against enumeration, sessions revoked on reset; login page link + pages
- profile hover cards on [data-user-card] elements (§11.13)
- keyboard shortcuts: g b/m/t/h navigation, / focuses search (§10)
- bulk archive endpoint (§11.9)
- hand-written OpenAPI 3.1 covering §6, served at /api/docs + yaml download
- make backup / make restore (mongodump archive via the mongo container)
- README: quick start, demo data, runbook, breaker/job operations, working
  Caddy + nginx reverse-proxy samples (WS block, client_max_body_size),
  documented later-stubs (§11.24)
- smoke.sh now exercises register → logout → login → me → board → pages

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

internal/store/passwordresets.go

@@ -0,0 +1,45 @@
+package store
+
+import (
+	"context"
+	"errors"
+	"fmt"
+	"time"
+
+	"go.mongodb.org/mongo-driver/v2/bson"
+	"go.mongodb.org/mongo-driver/v2/mongo"
+)
+
+// PasswordReset is a one-shot token (§11.22), reaped by TTL index.
+type PasswordReset struct {
+	Token     string    `bson:"_id"`
+	UserID    string    `bson:"userId"`
+	ExpiresAt time.Time `bson:"expiresAt"`
+}
+
+func (s *Store) CreatePasswordReset(ctx context.Context, token, userID string, ttl time.Duration) error {
+	_, err := s.DB.Collection("passwordResets").InsertOne(ctx, PasswordReset{
+		Token: token, UserID: userID, ExpiresAt: time.Now().UTC().Add(ttl),
+	})
+	if err != nil {
+		return fmt.Errorf("create password reset: %w", err)
+	}
+	return nil
+}
+
+// ConsumePasswordReset returns the userId for a live token and deletes it
+// atomically (single use).
+func (s *Store) ConsumePasswordReset(ctx context.Context, token string) (string, error) {
+	var pr PasswordReset
+	err := s.DB.Collection("passwordResets").FindOneAndDelete(ctx, bson.M{
+		"_id":       token,
+		"expiresAt": bson.M{"$gt": time.Now().UTC()},
+	}).Decode(&pr)
+	if errors.Is(err, mongo.ErrNoDocuments) {
+		return "", ErrNotFound
+	}
+	if err != nil {
+		return "", fmt.Errorf("consume password reset: %w", err)
+	}
+	return pr.UserID, nil
+}