Reset Password

Forgot-password / OTP reset. Prove ownership of the registered phone or email with the OTP it received (reuses the SMS/email OTP that already backs login), then set a new password — NO auth token and NO old password needed. Returns {token, user} so the SPA can drop straight into a logged-in session. The same endpoint backs the Settings "用验证码改密" path.