Add forgot-password flow, remove dead reset-password page

Summary

Added a forgot-password entry point on sign-in with a request-link page calling Goauth’s proxied /api/auth/forgot-password endpoint. Built a matching reset-password page/route/backend log-redaction first, then removed all of it after confirming Goauth’s emailed reset link goes straight to Goauth’s own domain and never routes back into Pennywise. Repositioned the Forgot password link below the Sign in button, bumped frontend to 5.0.2, and pushed three commits to main.

Decisions

• Password reset is entirely Goauth’s responsibility end-to-end (its own hosted page, its own domain) — Pennywise only ever handles the forgot-password request step
• Forgot-password success copy is always the same anti-enumeration message regardless of whether the email exists, matching Goauth’s own 200-always behavior

Learnings

• An initial plan assumption (that the reset email links back into the app’s own frontend route) turned out to be wrong once the external auth service’s actual mailer behavior was confirmed — worth verifying live link/redirect behavior for any email-based flow before building UI around an assumed URL contract