Start a password reset. ALWAYS returns 200 {"ok": true} — byte-identical whether or not the email is registered (no account enumeration). When the email DOES match a user, a single-use, 30-minute reset link is emailed (dev: logged). The token is never returned in this response.

IMPORTANT-1a: the token-INSERT + mail-send are scheduled via BackgroundTasks, not run inline — the response is written before that work happens, so a caller timing the request can't distinguish "email exists, token+mail scheduled" from "email unknown, nothing scheduled" by response latency (the one lookup that DOES run inline, user_id_by_email, is a single indexed SELECT either way).

RATE-LIMITED per IP (launch #7, 2026-08-12): without it a loop on a known member's address is a MAIL BOMB — one real Resend send per request, burning quota and the member's inbox. Same auth_limiter + rightmost-XFF IP as login/signup, checked BEFORE the lookup so a flood consumes no DB work. The 429 is still enumeration-safe: it's keyed on IP, never on whether the email exists.