Future: account activation and password reset by e-mail #12

Goal

Complete the account flows that start from an e-mail link: activating an account and resetting a forgotten password.

Scope

Operations of docs/product/features/authentication.md#operations:

• checkLink(token, purpose) with purpose activation or reset; tokens always in the body (AUTH-20).
• activateAccount: creates the password (AUTH-16) and makes the account active; the link is single-use and valid for 72 hours (AUTH-02, AUTH-03).
• requestPasswordReset(login): only for existing active logins, link valid for 2 hours; the response is identical in content and duration whether or not the login exists, so the e-mail goes through the background queue of ADR-0030 (AUTH-10, AUTH-11, ADR-0031).
• resetPassword: sets the new password and clears an active lockout (AUTH-12).
• Expired or used links answer 410 link_invalid with the right message for each purpose.
• Rate limiting on the reset request, per IP and per login (ADR-0023).

Done when

• Integration tests: activation link works once; expires after 72 hours (fake TimeProvider); invalid after "resend access"; reset link expires after 2 hours; identical response for existing and unknown logins; reset clears lockout.
• Messages verbatim from docs/product/features/authentication.md#messages.
• Build with zero warnings, all tests pass; the milestone's roadmap items in README.md are checked.

References

docs/product/features/authentication.md, ADR-0019, ADR-0023, ADR-0030, ADR-0031.