Forgot password link on the sign-in page

[karl-cta]

What and why

A member who forgets their password has nothing on the sign-in page today: an administrator has to issue a temporary password, or the host has to run statup reset-password. Since email notifications landed, Statup can send mail, so the sign-in page gains a "Forgot password?" link.

• With a mail server (SMTP_*) and the page address set, the member receives a single-use link valid for one hour, and is signed in once they choose a new password; their other sessions are closed.
• Without mail, the page explains what to do instead.
• The answer is the same whether the address has an account or not, and requests are rate limited per address and per account.

Work in progress, one commit per step.

Checklist

• cargo fmt --check, cargo clippy --all-targets -- -D warnings and cargo test pass
• I agree to the Contributor License Agreement