Request Password Reset

Email a password-reset link if the address names an eligible account.

Always answers 202 with the same body. The request path only checks the rate limits and schedules the same background task for every address; the account lookup, the token, the audit row and the email all happen after the response, on their own session, so neither the answer nor its timing reveals whether an account exists. Limited per client address (429) and per address (silently: no further emails).