Sends a Firebase password-reset link to the given email. No authentication
required (security: []) — it is called from the public "forgot password"
flow. It is not company-scoped.

To avoid account enumeration the endpoint always responds { success: true }
when the email is unknown or when Firebase rejects it. Rate-limited to 1
request per minute.