v1.6.2 - Password recovery

v1.6.2 — Password recovery

Added

• Public forgot password and reset password pages.
• SMTP configuration in Admin -> Notifications.
• Password reset tokens stored as SHA-256 hashes only.
• Reset token TTL: 30 minutes.
• Reset request rate limit: 3 requests per IP per 15 minutes.
• Neutral public reset response to avoid account enumeration.
• Audit trail for reset requests, SMTP missing/failure, email sent and reset completion.

Changed

• Login page now links to password recovery.
• Security log labels reset events separately from normal logins.
• README badges and current release blocks updated to v1.6.2.

Verified

• go test ./...
• docker compose build step-ui
• local step-ui container healthy after rebuild
• password reset token flow with token consumption and login after reset