feat(auth): forgot password flow and login by email or username

[BODMAT]

Password reset via email link and sign-in by email or username.

Backend

• New POST /forgot-password - creates a reset token (1h TTL), sends link to user email. Always returns 200 to prevent email enumeration. Skips Google-only accounts.
• New POST /reset-password - validates token, hashes and saves new password, upserts local identity.
• Login handler now accepts email or username - searches by email if input contains @, else by login.
• @ forbidden in usernames (RegisterSchema, UpdateProfileSchema) to keep the distinction unambiguous.
• New passwordResetHandlers.ts, sendPasswordResetEmail in emailService, ForgotPasswordSchema and ResetPasswordSchema added to AuthSchema.

Frontend

• ForgotPasswordStage.tsx - email input form with "Check your inbox" success state, added as forgot stage in AuthPopup.
• ResetPasswordPopup.tsx - two-field password form opened automatically when user follows ?auth=reset_password&token=... link.
• "Forgot password?" link below password field in sign-in mode.
• "Forgot password?" button in AccountSettings - Password section - sends reset link directly to user's email.
• forgotPassword and resetPassword mutations added to auth.api.