feat: seed script, forgot-password, hover cards, shortcuts, OpenAPI docs, runbook (phase 12)

- scripts/seed.go: idempotent demo data per §11.11 (make seed)
- forgot/reset password: SMTP-gated, one-shot TTL tokens, uniform responses
  against enumeration, sessions revoked on reset; login page link + pages
- profile hover cards on [data-user-card] elements (§11.13)
- keyboard shortcuts: g b/m/t/h navigation, / focuses search (§10)
- bulk archive endpoint (§11.9)
- hand-written OpenAPI 3.1 covering §6, served at /api/docs + yaml download
- make backup / make restore (mongodump archive via the mongo container)
- README: quick start, demo data, runbook, breaker/job operations, working
  Caddy + nginx reverse-proxy samples (WS block, client_max_body_size),
  documented later-stubs (§11.24)
- smoke.sh now exercises register → logout → login → me → board → pages

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

web/static/js/reset-password.js

@@ -0,0 +1,19 @@
+import { api } from '/static/js/api.js';
+
+document.getElementById('reset-form').addEventListener('submit', async (e) => {
+  e.preventDefault();
+  const errorBox = document.getElementById('error');
+  errorBox.textContent = '';
+  const pw = document.getElementById('new').value;
+  if (pw !== document.getElementById('confirm').value) {
+    errorBox.textContent = 'Passwords do not match.';
+    return;
+  }
+  try {
+    await api('POST', '/api/v1/auth/reset', {
+      token: new URLSearchParams(window.location.search).get('token') || '',
+      newPassword: pw,
+    });
+    window.location.href = '/login';
+  } catch (err) { errorBox.textContent = err.message; }
+});