Restore account access.

A time-limited recovery link will be sent to the account email address.

• Generic response protects account privacy
• Recovery links expire automatically
• Existing sessions are revoked after reset