feat(password): add reset and change password pages

/reset-password page for the email request and the new password,
ChangePasswordCard in settings, password reset button on the admin
users page, 'Forgot password?' link on the login page, de/en texts.

README.md

@@ -102,6 +102,11 @@ To Be Played is split into three repositories:
   body); the page asks for the password (and its repeat) and confirms on a button click, not on load, so mail scanners do not burn the link. An expired or used
   link and the page after the send offer "send the link
   again" (same answer for any address).
+- **Forgot password** (`/reset-password`): the login page links to it. Without a fragment it asks for the email and
+  shows the same text for any address. The mail link opens `/reset-password#<token>` (fragment, sent in a POST body on
+  the button click only): the page asks for the new password twice. A used or expired link shows the email form again.
+  **Change password** is a card in the settings (current password and the new one twice); the other logins end, this
+  one stays. The admin users page has "Send password reset" for an active, unblocked user.
 - **Broken pictures**: a Steam cover or achievement icon that does not load shows a placeholder and is reported
   to Core once per page load (`POST /api/library/broken-images`, only with a session). Core repairs it at night;
   a repaired cover comes back as `imageUrl`.