feat: custom password reset flow (token-based, Appwrite Messaging)

- db: new password_resets table (email, userId, tokenHash, expiresAt, usedAt)
- lib: password-reset-actions.ts — requestPasswordResetAction, verifyResetToken, resetPasswordAction
- lib: Messaging added to createAdminClient
- page: /reset-password — validates token server-side, shows form or error card
- page: /forgot-password — now uses requestPasswordResetAction (custom flow)
- page: /sign-in — shows success banner after ?reset=success redirect

src/app/(auth)/sign-in/page.tsx

@@ -6,11 +6,11 @@ import { getCurrentUser } from "@/lib/appwrite/server";
 export default async function Page({
   searchParams,
 }: {
-  searchParams: Promise<{ invite?: string }>;
+  searchParams: Promise<{ invite?: string; reset?: string }>;
 }) {
-  const { invite } = await searchParams;
+  const { invite, reset } = await searchParams;
   const user = await getCurrentUser();
   if (user) redirect(invite ? `/d/${invite}` : "/dashboard");
 
-  return <LoginForm1 inviteCode={invite} />;
+  return <LoginForm1 inviteCode={invite} passwordReset={reset === "success"} />;
 }