We'll email you a secure, single-use link to set a new password.
Prototype: no email is actually sent. In production this triggers a single-use, time-boxed token and invalidates existing sessions on reset.