Forgot password — request the link / complete with it

Stage one — `{"email"}`: mails a one-time link `FRONTEND_HOST/auth/sign-in?uuid=…`. A blocked or deleted account answers `404` like an unknown one; an UNCONFIRMED account may recover (owner 08.10.2026). Stage two — `{"uuid"}`: spends the link, mails a new password, ends every session of the account, and confirms an unconfirmed one. Same contract as `POST /api/v1/auth/reset-password` otherwise.

curl -X POST "https://example.com/api/v2/auth/reset-password" \  -H "Content-Type: application/json" \  -d '{}'