Public endpoint — no API key required. Always returns 204 regardless of whether the
address is recognised, to avoid leaking information about registered accounts.

Rate limited to 5 requests per IP per 15-minute window.

Tenant context is derived from the subdomain in the request host, so the reset email
will be branded for the tenant at that URL. Because the underlying auth account is
shared across tenants, resetting via any tenant URL resets the same credential.

Required Permission(s): Admin