feat: implement forgot password, added security updates

.env.example

@@ -28,6 +28,12 @@ COOKIE_SECRET=replace-with-32+-chars
 COOKIE_DOMAIN=skymoneybudget.com
 AUTH_MAX_FAILED_ATTEMPTS=5
 AUTH_LOCKOUT_WINDOW_MS=900000
+PASSWORD_RESET_TTL_MINUTES=30
+PASSWORD_RESET_RATE_LIMIT_PER_MINUTE=5
+PASSWORD_RESET_CONFIRM_RATE_LIMIT_PER_MINUTE=10
+UPDATE_NOTICE_VERSION=3
+UPDATE_NOTICE_TITLE=SkyMoney Update
+UPDATE_NOTICE_BODY=We shipped account security improvements, including a new password reset flow and stronger session protections.
 
 # Email (verification + delete confirmation)
 SMTP_HOST=smtp.example.com