fix(backend): implement password reset service with rate limiting and abuse prevention

[MJ-RWA]

Implements secure password reset for Revora-Backend — passwordResetService, passwordResetRateLimiter, DB migration, error types, routes, and tests. Backend-scoped only.

What Changed

DB: Migration for password_reset_tokens table (hashed token, expiry, single-use flag)
Service: requestPasswordReset + resetPassword — 256-bit tokens, SHA-256 hashed at rest, 15-min expiry, old tokens invalidated on re-request
Middleware: Rate limiter — 5 req / 15 min / IP on both endpoints
Routes: POST /request + POST /reset behind rate limiter, Zod-validated
Tests: ≥95% coverage — happy path, expired/used/unknown token, enumeration prevention, rate limit trigger

Closes: #247

[drips-wave]

@MJ-RWA Great news! 🎉 Based on an automated assessment of this PR, the linked Wave issue(s) no longer count against your application limits.

You can now already apply to more issues while waiting for a review of this PR. Keep up the great work! 🚀

Learn more about application limits