Forgot password
Submit reset requests to /api/v1/auth/forgot-password.
Show delivery state and next-step instructions.
Return the user to /reset-password once the token is available.
