Operator Reset Page

Render the set-new-password form. Token validation is purely cosmetic here — the real check happens on POST. We do show an immediate "link expired or invalid" page when the token is unknown.