Add missing forgot-password, terms, and privacy pages

Problem

login.stx links to /forgot-password and register.stx links to /terms and /privacy, but those views don't exist (404). Password-reset API routes exist with no frontend.

Acceptance

• Create forgot-password (wired to the reset API), terms, and privacy views.
• All footer/auth links resolve.

Done in baceaa3.

Added the three pages the auth flow linked to (previously 404):

• /forgot-password — wired to POST /api/password/forgot; shows a generic 'check your inbox' confirmation regardless of whether the address exists (no email-enumeration), surfaces rate-limit (429) and network errors.
• /terms and /privacy — static legal pages, dark-mode aware, cross-linked, with a back-to-sign-up link.

Views are file-routed (there's no web.ts), so login.stx's /forgot-password link and register.stx's /terms + /privacy links now resolve.