Sends a password reset email to the specified address if an account with that email exists and has a password set. The reset link in the email expires after 1 hour.The response is always a generic success message regardless of whether the email is registered. This prevents user enumeration.
Generic confirmation message: "If an account with that email exists, a password reset link has been sent."
The password reset token is stored as a SHA-256 hash in the database.
Only one reset token is active per user at a time — requesting a new one
overwrites the previous token.