Reset Password

Complete a password reset (SEC-AUTH-013).

Validates the token (exists, not expired, not used), enforces the signup password-strength policy (done by the schema → 422 on weak), sets the new hash, marks the token used (single-use), and revokes every refresh-token chain for the user so any session an attacker established with the old password is killed. Emits password_reset_completed.

#1414 (security review F2): a completed reset also clears the account's sign-in lockout counter. Anyone who knows an account's email can keep its password sign-in locked by sending five wrong passwords every window; proving mailbox control is the owner's way back in. The per-address counter is left alone, as on a successful sign-in.

Any token failure (missing / expired / already used) → ONE opaque 400 so a prober can't distinguish the cases.