Scope: POST /api/auth/forgot — look up by email, store a single-use RESET#{token} (short TTL), email the reset link. Always 200 (no account enumeration).
Done when: a reset email is sent for known accounts; response is identical for unknown ones.