Send the branded password reset email.

Unauthenticated on purpose: the requester has, by definition, lost their credentials. The response never reveals whether the account exists; the service reports unknown accounts (and throttled repeats) as sent. The fallback flag tells the web client to use Firebase's built-in reset email when the branded send is unavailable.