Fix login page UX + add password reset flow

- Move Field component outside RegisterForm — fixes focus loss on every keystroke
- Remove setError('') at submit start — fixes error "flash" that looked like page reload
- Clear errors onChange instead, so error persists until user starts correcting
- Add 'Forgot password?' link in LoginForm
- Add ForgotPasswordForm (email input, success state)
- Add ResetPasswordPage at /reset-password?token=...
- Backend: POST /api/auth/forgot-password — generates 1h token, sends email
- Backend: POST /api/auth/reset-password — validates token, updates password hash
- Backend: migration 006 — reset_token/reset_token_expires columns
- Backend: sendPasswordResetEmail in email.ts

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

src/lib/api.ts

@@ -155,6 +155,12 @@ export const api = {
       password: string
     }) =>
       req<{ ok: boolean; message: string }>('POST', '/api/auth/register', data),
+
+    forgotPassword: (email: string) =>
+      req<{ ok: boolean }>('POST', '/api/auth/forgot-password', { email }),
+
+    resetPassword: (token: string, password: string) =>
+      req<{ ok: boolean }>('POST', '/api/auth/reset-password', { token, password }),
   },
 
   // ── Rooms ─────────────────────────────────────────────────────────────────