feat: seed script, forgot-password, hover cards, shortcuts, OpenAPI docs, runbook (phase 12)

- scripts/seed.go: idempotent demo data per §11.11 (make seed)
- forgot/reset password: SMTP-gated, one-shot TTL tokens, uniform responses
  against enumeration, sessions revoked on reset; login page link + pages
- profile hover cards on [data-user-card] elements (§11.13)
- keyboard shortcuts: g b/m/t/h navigation, / focuses search (§10)
- bulk archive endpoint (§11.9)
- hand-written OpenAPI 3.1 covering §6, served at /api/docs + yaml download
- make backup / make restore (mongodump archive via the mongo container)
- README: quick start, demo data, runbook, breaker/job operations, working
  Caddy + nginx reverse-proxy samples (WS block, client_max_body_size),
  documented later-stubs (§11.24)
- smoke.sh now exercises register → logout → login → me → board → pages

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

web/templates/forgot-password.html

@@ -0,0 +1,17 @@
+{{define "content"}}
+<div class="card">
+  <h1>Forgot password</h1>
+  <div class="error-box" id="error" role="alert"></div>
+  <div class="ok-box" id="ok" role="status"></div>
+  <form id="forgot-form">
+    <div class="field">
+      <label for="email">Email</label>
+      <input type="email" id="email" autocomplete="email" required>
+    </div>
+    <div class="spread">
+      <button class="btn primary" type="submit">Send reset link</button>
+      <a href="/login">Back to log in</a>
+    </div>
+  </form>
+</div>
+{{end}}

web/templates/layout.html

@@ -57,7 +57,8 @@
   </main>
   <div id="toasts" aria-live="polite"></div>
   <script type="module" src="/static/js/nav.js"></script>
-  {{if .User}}<script type="module" src="/static/js/notifications.js"></script>{{end}}
+  {{if .User}}<script type="module" src="/static/js/notifications.js"></script>
+  <script type="module" src="/static/js/shortcuts.js"></script>{{end}}
   {{range .Scripts}}<script type="module" src="{{.}}"></script>
   {{end}}
 </body>

web/templates/login.html

@@ -13,7 +13,7 @@
     </div>
     <div class="spread">
       <button class="btn primary" type="submit">Log in</button>
-      <a href="/register">Create an account</a>
+      <span><a href="/forgot-password">Forgot password?</a> · <a href="/register">Create an account</a></span>
     </div>
   </form>
   {{if .OIDCEnabled}}

web/templates/reset-password.html

@@ -0,0 +1,17 @@
+{{define "content"}}
+<div class="card">
+  <h1>Set a new password</h1>
+  <div class="error-box" id="error" role="alert"></div>
+  <form id="reset-form">
+    <div class="field">
+      <label for="new">New password</label>
+      <input type="password" id="new" autocomplete="new-password" minlength="8" required>
+    </div>
+    <div class="field">
+      <label for="confirm">Confirm new password</label>
+      <input type="password" id="confirm" autocomplete="new-password" minlength="8" required>
+    </div>
+    <button class="btn primary" type="submit">Set password</button>
+  </form>
+</div>
+{{end}}