feat(auth): add password reset flow

Add admin-generated reset links, reset UI, timezone-aware expiry display, and registration captcha coverage.

app/__init__.py

@@ -10,6 +10,7 @@ from .extensions import db, login_manager
 from .models import AppSetting, User
 from .prediction import FEATURES, load_model
 from .security import csrf_token, validate_csrf_token
+from .time_utils import format_datetime_for_timezone
 
 
 def create_app(config_object: type[Config] = Config, *, load_model_on_start: bool = True) -> Flask:
@@ -91,9 +92,13 @@ def register_app_hooks(app: Flask) -> None:
         def now_year() -> int:
             return datetime.now().year
 
+        def format_datetime(value) -> str:
+            return format_datetime_for_timezone(value, app.config["APP_TIMEZONE"])
+
         return {
             "feature_list": FEATURES,
             "now_year": now_year,
+            "format_datetime": format_datetime,
             "csrf_token": csrf_token,
             "allow_registration": AppSetting.get_bool(
                 "allow_registration",