Password reset

Email a reset link

If outgoing email is configured (Resend), we send a one-hour link. Otherwise only development logs may show the link—set RESEND_API_KEY and RESEND_FROM for production.