feat(auth): add password reset flow

Add admin-generated reset links, reset UI, timezone-aware expiry display, and registration captcha coverage.

app/models.py

@@ -24,6 +24,25 @@ class User(UserMixin, db.Model):
         return check_password_hash(self.password_hash, password)
 
 
+class PasswordResetToken(db.Model):
+    __tablename__ = "password_reset_tokens"
+
+    id = db.Column(db.Integer, primary_key=True)
+    user_id = db.Column(db.Integer, db.ForeignKey("users.id"), nullable=False, index=True)
+    created_by_id = db.Column(db.Integer, db.ForeignKey("users.id"), nullable=False)
+    token_hash = db.Column(db.String(64), unique=True, nullable=False, index=True)
+    expires_at = db.Column(db.DateTime, nullable=False)
+    used_at = db.Column(db.DateTime)
+    created_at = db.Column(db.DateTime, default=datetime.utcnow, nullable=False)
+
+    user = db.relationship(
+        "User",
+        foreign_keys=[user_id],
+        backref=db.backref("password_reset_tokens", lazy=True),
+    )
+    created_by = db.relationship("User", foreign_keys=[created_by_id])
+
+
 class UploadRecord(db.Model):
     __tablename__ = "upload_records"