Request a password reset
POST /auth/forgot-password
Always returns the same generic response whether or not the email is registered, to prevent account enumeration — same convention as POST /login.
Rate limited: 10 requests per IP per 15 minutes.
Request