- POST /auth/forgot-password with welcome/reset email templates
- POST /auth/reset-password with Zod validation, 4-hour tokens
- Per-email rate limiting (3/hr) via Valkey, no user enumeration
- Login page "Forgot password?" toggle with inline form
- /reset-password page for setting new password from email link
- Initial user seed sends welcome email instead of requiring password
- CLI script for force-resetting passwords via kubectl exec
- APP_URL env var in chart, removed INITIAL_USER_PASSWORD
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
- Add chart/ with backend, frontend, valkey deployments, services, and ingress
- Update nginx.conf to use BACKEND_URL env var via envsubst
- Update Dockerfile.frontend to use nginx template mechanism
- Build.yml: switch Docker registry from Gitea to DOCR, add helm package+push step
