Mint a password-reset link for a user (internal support tooling)

Generates a fresh password-reset token for the given user and returns the reset link so an internal support agent can hand it to the person directly (e.g. on a call) instead of only emailing it. Restricted to internal staff at the support tier or above. The link is valid for 7 days.