feat: implement password reset via UI-configured system mail provider

- replace env-var SMTP config with DB-backed system mail provider
- add isSystemProvider flag to emailProviders table
- add SystemMailService for sending password reset emails
- add PATCH :id/system and DELETE system endpoints on email providers
- add forgotPassword/resetPassword audit logging with IP tracking
- block OIDC and inactive users from password reset flow
- fire-and-forget async work to prevent email enumeration timing oracle
- add HTML email template for password reset
- remove mailer.service and all SMTP env vars

packages/types/src/audit.ts

@@ -4,6 +4,8 @@ export enum AuditAction {
   AuthLoginFailed = 'auth.login.failed',
   AuthLogout = 'auth.logout',
   AuthPasswordChange = 'auth.password.change',
+  AuthPasswordResetRequest = 'auth.password.reset_request',
+  AuthPasswordReset = 'auth.password.reset',
   AuthPasswordAdminReset = 'auth.password.admin_reset',
   AuthSessionRevoke = 'auth.session.revoke',
 
@@ -62,6 +64,8 @@ export enum AuditAction {
   EmailProviderUpdate = 'email.provider.update',
   EmailProviderDelete = 'email.provider.delete',
   EmailProviderSetDefault = 'email.provider.set_default',
+  EmailProviderSetSystem = 'email.provider.set_system',
+  EmailProviderClearSystem = 'email.provider.clear_system',
 
   EmailTemplateCreate = 'email.template.create',
   EmailTemplateUpdate = 'email.template.update',