Choose a new password

Mock reset screen. Phase 6 adds expiring, single-use reset tokens.

This form is a frontend shell. Real auth, httpOnly sessions, email verification, and password reset wire in during Phase 6.