Forgot password
The link is valid for 2 hours. No mail server is wired to this
flow — the operator pastes the link to the user out-of-band
(support ticket / direct message). Operators themselves should
rotate via passwd on the host or via
/admin/users.