Secure Account Recovery

Recover access without exposing whether an account exists.

Password-reset requests use expiring, single-use links and invalidate prior unused reset tokens.