Reset

Reset the Portal's login credentials -- unauthenticated, identity-carrying devices only.

Deliberately carries no require_auth/require_provisioned_unless_identity, unlike every other endpoint here: a forgotten owner password otherwise blocks the Wi-Fi setup flow itself (Wi-Fi is session-gated the moment an identity file exists -- :func:~palmimo_portal.api.deps.require_wifi_access), so a reset must work before Wi-Fi is configured and without a session. The DIY case is refused by :func:~palmimo_portal.core.auth.decide_reset itself.

This is the one unauthenticated state-changing action in the API -- anyone on the LAN can trigger it on an identity-carrying device, by design, as a bounded nuisance/DoS (device lands back in initial mode, gated to the sticker password, never handed to the caller). Every accepted reset is logged at WARNING with the caller's address, and throttled process-wide to one per :data:~palmimo_portal.core.auth.RESET_LOCKOUT_SECONDS via :meth:~palmimo_portal.core.auth.ResetRateLimiter.try_acquire (separate budget from :class:~palmimo_portal.core.auth.LoginRateLimiter, engaged only on an accepted reset, released again if :meth:~palmimo_portal.ports.StateStore.delete_auth then fails).

Reads identity via :meth:~palmimo_portal.ports.IdentityStore.read_identity_uncached, not the cached read every other endpoint uses -- this decision must never be made from a stale cache of an identity file since removed.

Raises: PortalError: 429 auth_rate_limited while throttled -- checked twice: a cheap non-atomic peek via :meth:~palmimo_portal.core.auth.ResetRateLimiter.is_locked before the identity/auth-state read, and again via :meth:~palmimo_portal.core.auth.ResetRateLimiter.try_acquire right before the delete, which atomically spends the budget; 403 reset_not_available on a DIY device (no identity file); 503 identity_unavailable if the identity file could not be read (see :func:setup); 409 auth_not_set if the device is already in initial mode (nothing to reset); 409 auth_change_in_progress if a concurrent password change is already holding :meth:~palmimo_portal.ports.StateStore.lock_auth past its timeout.