Password recovery

available is false when this deployment has no SMTP relay (ANKRA_CLOUD_SMTP_HOST); the portal then says recovery is unavailable instead of offering a form whose link would never arrive.

Always answers 202 with the same body, whether or not the address has an account, and whether or not mail is configured: nothing in the answer, its timing or its status says whether an account exists. For an address that has a user, a random 32-byte token (base64url) is issued, only its SHA-256 is stored, and <portal origin>/reset-password?token=<token> is emailed; the portal origin is the request's Origin when it is one of the configured portal origins (ANKRA_CLOUD_PORTAL_URLS), else the first. The link works once, for 30 minutes. At most 3 links are sent to one user per 15 minutes (further requests answer the same and send nothing). Rate limited per client network (5 a minute) and per email address (5 an hour), answering 429 for any address alike. Users without a password (signed up through an identity provider) can set one this way.

Checks the token (looked up by its SHA-256; unused and unexpired), applies the signup password policy (12 to 1024 characters, not a known breached password), stores the argon2id hash, spends the token and every other open reset token of the user, ends every session and revokes every API token of the user, removes a TOTP second factor enrolled before the address was verified (with its recovery codes) and records user.password_reset in the account's audit log, all before answering 204. The reset verifies the address. The user then signs in with the new password. A refusal is a 400 problem with a stable reason: invalid_token, expired_token, used_token or weak_password (a refused password leaves the token usable). Rate limited per client network (10 a minute).