Add self-service password change, forgot-password flow, and fix admin UI bugs

Users can change their own password from the profile modal, and a
"forgot password" link sends a 15-minute expiring reset link (same
hashed-token pattern as site invites). The forgot-password response is
always generic so it never reveals which emails are registered.

Also fixes two admin-page display bugs found while testing: table row
divider lines that didn't line up across a row (the actions column had
`display: flex` on the <td> itself, breaking it out of normal table-cell
layout -- moved to a child <div>), and the pending-invites list floating
with no visual grouping (now boxed with a label and per-status badges).

backend/app/models/__init__.py

@@ -7,6 +7,7 @@ from app.models.membership import RoomMembership, RoomRole
 from app.models.message import Message
 from app.models.message_image import MessageImage
 from app.models.message_reaction import MessageReaction
+from app.models.password_reset import PasswordReset
 from app.models.push_subscription import PushSubscription
 from app.models.room import Room
 from app.models.site_invite import SiteInvite
@@ -24,6 +25,7 @@ __all__ = [
     "MessageImage",
     "MessageReaction",
     "InviteStatus",
+    "PasswordReset",
     "SiteInvite",
     "SmtpSettings",
     "PushSubscription",

backend/app/models/password_reset.py

@@ -0,0 +1,33 @@
+import uuid
+from datetime import datetime, timedelta, timezone
+
+from sqlalchemy import Boolean, DateTime, ForeignKey, String, func
+from sqlalchemy.orm import Mapped, mapped_column, relationship
+
+from app.models.base import Base
+
+DEFAULT_RESET_LIFETIME = timedelta(minutes=15)
+
+
+def _default_expires_at() -> datetime:
+    return datetime.now(timezone.utc) + DEFAULT_RESET_LIFETIME
+
+
+class PasswordReset(Base):
+    __tablename__ = "password_resets"
+
+    id: Mapped[uuid.UUID] = mapped_column(primary_key=True, default=uuid.uuid4)
+    user_id: Mapped[uuid.UUID] = mapped_column(ForeignKey("users.id"), index=True, nullable=False)
+    # Same convention as SiteInvite.token_hash / API tokens: a bearer secret
+    # looked up by itself, so it's hashed with security.hash_token (fast,
+    # deterministic sha256), not argon2.
+    token_hash: Mapped[str] = mapped_column(String(64), unique=True, index=True, nullable=False)
+    used: Mapped[bool] = mapped_column(Boolean, default=False, nullable=False)
+    expires_at: Mapped[datetime] = mapped_column(
+        DateTime(timezone=True), default=_default_expires_at, nullable=False
+    )
+    created_at: Mapped[datetime] = mapped_column(
+        DateTime(timezone=True), server_default=func.now(), nullable=False
+    )
+
+    user = relationship("User")