feat(#127): mot de passe oublié — flux complet (API + web + e-mail)

- API publique POST /auth/forgot-password et /auth/reset-password (jeton
  password_reset_*, anti-énumération, e-mail P'titsPas)
- BDD: colonnes password_reset_token / password_reset_expires + index
- Front: écrans /forgot-password, /reset-password, lien login, mutualisation
  formulaires par token
- Template e-mail + alignement couleur; tests unitaires (auth, mail)

Merge depuis develop: branche feature/127.

Made-with: Cursor

frontend/lib/config/app_router.dart

@@ -19,6 +19,8 @@ import '../screens/auth/am_register_step2_screen.dart';
 import '../screens/auth/am_register_step3_screen.dart';
 import '../screens/auth/am_register_step4_screen.dart';
 import '../screens/auth/create_password_screen.dart';
+import '../screens/auth/forgot_password_screen.dart';
+import '../screens/auth/reset_password_screen.dart';
 import '../screens/home/home_screen.dart';
 import '../screens/administrateurs/admin_dashboardScreen.dart';
 import '../screens/gestionnaire/gestionnaire_dashboard_screen.dart';
@@ -55,6 +57,15 @@ class AppRouter {
         builder: (BuildContext context, GoRouterState state) =>
             CreatePasswordScreen(token: state.uri.queryParameters['token']),
       ),
+      GoRoute(
+        path: '/forgot-password',
+        builder: (BuildContext context, GoRouterState state) => const ForgotPasswordScreen(),
+      ),
+      GoRoute(
+        path: '/reset-password',
+        builder: (BuildContext context, GoRouterState state) =>
+            ResetPasswordScreen(token: state.uri.queryParameters['token']),
+      ),
       GoRoute(
         path: '/home',
         builder: (BuildContext context, GoRouterState state) => const HomeScreen(),