Finish a password reset with the token from the email

Sets a new password from the token minted by /v1/auth/password/forgot. Every session on the account is invalidated — a stolen session must not survive the reset meant to shut it out — but API keys are left alone. No session is issued here: signing back in still goes through /v1/auth/login, which is what enforces a second factor, so a stolen reset link cannot be used to skip past TOTP.