Auth: reset-password (consume token, set new password)

Scope: POST /api/auth/reset — validate the RESET#{token}, set the new (hashed) password, invalidate the token + all existing sessions.

Done when: a valid token resets the password once; expired/used tokens are rejected.