Password reset

This MVP stores a reset token placeholder. Wire your mail provider in production.