Password recovery

Reset workflow reserved

The password reset tables are installed in Phase 1. Provider-backed email delivery is intentionally not enabled until a real mail service is configured.