Add simple email password reset

Add forgot-password → email → single-use link → new password to the independent identity platform. Reuse existing server-rendered authentication components, anonymous session/CSRF, Argon2 password policy, local mail worker and atomic database/history/outbox conventions. Support en/nb/da, light/dark and no JavaScript. Use synthetic data only; no commits requested. Acceptance: generic request confirmation, bounded requests and mail cooldown, expiring purpose-bound single-use reset tokens stored only as digests, atomic password replacement with session revocation and safe audit records, invalid/expired/replayed links fail safely. Registration remains separate. Focused PostgreSQL/HTTP/browser regressions and standard validation pass; documentation reflects behavior and local-mail limitation. Implemented: migration 0011, separate reset service/HTTP/views, direct forgot action on selected-email password stage plus standalone recovery form, purpose-separated local mail tokens, five-minute cooldown, 30-minute single-use links, credential-version binding and atomic password/history/outbox/session revocation. Anonymous request/replacement audit events use an account recovery service actor; verified acceptance uses the account actor. Existing mail worker now supports both link purposes and explicitly releases its transaction on digest mismatch/no work. Verified: formatting, strict workspace Clippy, ordinary Rust tests and full synthetic PostgreSQL/dev gate pass, including four reset regressions for concurrent consumption, old-password/session rejection, CSRF/origin/tenant/expiry/disable rejection, cooldown/replacement/credential changes, audit actor/secrecy, request/completion outbox-failure rollback and runtime write restrictions. First complete browser gate passed real Mailpit links in all four light/dark × JS on/off combinations with nb/da/en forms, short-password validation, clean token handoff, replay, old-session revocation and new-password sign-in. Final complete browser gate after audit/mail-lock corrections also passes (eight component cases plus all four authenticated user journeys). UI screenshots inspected at desktop/tablet/mobile; public recovery inspector reports zero failures and four shared-layout warnings (development marker, deliberately narrow/quiet auth canvas, existing title size). Source linter does not support Rust/Maud. Local validation helper had applied the earlier unpublished migration draft to the shared synthetic development database. Verified exact draft checksum and synthetic provenance, then transactionally replaced only its four function definitions and synchronized that new migration checksum; no tables/records/accounts were deleted or reset. Fresh test databases apply the final migration normally. Partial patch-scoped static review identified the anonymous audit attribution issue; it was reproduced with a failing assertion, fixed and verified. The review was not a full-project audit. All acceptance and standard validation gates pass; changes remain uncommitted.