fix(1456): forgot-password no longer leaks whether email is registered

[rumblefrog]

Summary

Closes #1456. The Forgot Password endpoint (auth.lost_password) no
longer reveals whether the submitted email is registered.

• Before: a registered email returned a Check E-Mail success
  envelope; an unregistered email returned error: not_registered
  with the message "The email address you supplied is not registered
  on the system"; SMTP failure returned error: mail_failed. Any
  anonymous visitor could enumerate registered admin accounts one
  request at a time.
• After: every reachable branch — matched, unmatched, mail-failed
  — returns the same generic envelope: {ok: true, data: {message: {title: 'Check E-Mail', body: 'If an account is registered to that email address, a password reset link has been sent. Please check your inbox (and your spam folder).', kind: 'blue'}}}. The DB
  write + SMTP round-trip still only run when the row matches; the
  miss branch returns the envelope without touching :prefix_admins
  or the mailer (so the handler is NOT an open-relay vector).

The fix follows the OWASP Forgot Password Cheat Sheet's "Return a
consistent message" guidance and mirrors Django's password_reset,
Rails's devise/recoverable, and GitHub's password-recovery
defaults.

Why not just hide the error message?

The wire shape was the oracle, not just the rendered toast. Even
without rendering, a curl-driven attacker could read the JSON
envelope's error.code (not_registered vs mail_failed vs
ok: true) to enumerate. The fix collapses all three branches to a
single envelope shape so the wire layer no longer signals.

Sibling auth surfaces (audit findings)

• api_account_change_email is gated to authenticated owners and
  returns a generic validation error for email_taken — no
  per-target leak.
• api_auth_login HAS a sibling enumeration oracle (empty-password
  short-circuit returns ?m=empty_pwd for known users vs ?m=failed
  for unknown users, and the lockout-after-5 gate does NOT protect
  against this because it fires downstream of the short-circuit).
  Documented under "Public auth surfaces: response-shape uniformity"
  in AGENTS.md as a tracking follow-up — out of scope for Forgot Password - Leaks if email address is valid or not #1456
  because it's a different code path with its own UX implications
  (the login form's error copy needs a parallel pass).

Residual timing / log-DoS surface (documented, not closed)

• Timing: the matched branch does ~2 DB queries + an SMTP
  round-trip; the unmatched branch does 1 DB query and returns
  immediately. A network-side attacker can statistically distinguish
  the two with enough samples. Closing requires either constant-time
  execution (always send a real mail, e.g. to a sink address, on
  the miss branch — wasteful + spam-vector) or a per-IP rate limit
  the panel doesn't currently have. Acknowledged in the handler
  docblock + AGENTS.md.
• Log-DoS on matched-branch SMTP-failure: an attacker who knows
  a single registered email AND catches the panel with broken SMTP
  can hammer the endpoint to flood :prefix_log (each failure logs
  an audit entry) AND roll the legitimate user's outstanding
  validate token on every request. Closing requires a per-(IP ×
  email) rate limiter. Documented in AGENTS.md "Audit-log
  discipline".

Neither is the user-enumeration vulnerability the issue calls out;
both are flagged for a follow-up.

Audit logging

• Mail-send failures emit a Log::add(LogType::Error, 'Password reset mail failed', …) entry so operators can diagnose SMTP
  misconfiguration. Mail::send already logs the underlying
  transport exception ("Mail not configured" / "Mail error" /
  "Mail send failed"); the handler adds a paired entry that pins
  the action that triggered it.
• The miss branch does NOT log. Logging it would (1) let any
  anonymous caller write to :prefix_log at request rate (DoS
  amplification) and (2) be a side-channel into "this address is
  unknown" visible to anyone who reads the audit log.

Files

• web/api/handlers/auth.php — collapse three branches to one
  generic envelope via _api_auth_lost_password_generic_response().
  Single source for the wire shape; load-bearing copy.
• web/tests/api/AuthTest.php — 6 new tests pin the contract:
  identical envelope across known + unknown emails (the marquee
  contract), no DB touch on the miss branch, validate-token roll
  on the match branch, Mail::send actually reached on the match
  branch (verified via audit-log entries), and the
  ?config.enablenormallogin=0 branch returns a byte-identical
  envelope regardless of whether the email matched.
• web/tests/api/__snapshots__/auth/lost_password_generic.json —
  new snapshot for the generic envelope. The pre-fix
  lost_password_not_registered.json + lost_password_mail_failed.json
  snapshots are deleted.
• web/tests/e2e/specs/flows/lostpassword-toast.spec.ts — 2 new
  end-to-end tests drive the form submission for known + unknown
  emails and assert the SAME generic toast paints. Uses a
  dedicated lostpw-enum-known@example.test admin row (seeded
  idempotently via the new shim) so the validate-token UPDATE
  doesn't race the marquee Audit follow-up: silent <script>ShowBox(...)</script> blobs lose user feedback on lostpassword / protest / banlist / commslist / admin.edit.comms #1403 happy-path test across Playwright
  projects.
• web/tests/e2e/scripts/seed-lostpassword-enum-admin-e2e.php +
  web/tests/e2e/fixtures/db.ts — new shim + TS wrapper for the
  dedicated admin row.
• AGENTS.md — new "Public auth surfaces: response-shape
  uniformity" convention block, matching Anti-patterns entry,
  "Where to find what" row, and the sibling api_auth_login +
  log-DoS follow-up notes.
• web/pages/page.lostpassword.php — comment clarification only;
  the page handler still surfaces the disabled-form fallback and
  the email-shape inline error, which are NOT enumeration channels.
• web/scripts/api-contract.js — regenerated to pick up updated
  handler docblock.

Test plan

• PHPStan (level 5): no errors
• PHPUnit (full suite): 984 tests, 3552 assertions, all pass
  (11 AuthTest cases, including 6 new ones pinning the
  enumeration-prevention contract)
• api-contract: regenerated, no diff
• ts-check: clean
• E2E (lostpassword-toast): 22 passed under --workers=1
  (mirrors CI behaviour per AGENTS.md "Playwright E2E specifics")
• Manually verified: hostile caller hitting auth.lost_password
  with an unknown email gets the same envelope as a hit on a
  registered email (admin@example.test)
• Adversarial review pass: addressed all 4 substantive findings
  (S1-S4) + 2 nits (N1-N2)