feat: implement forgot password endpoint

[JamesVictor-O]

Summary

• Implements POST /api/auth/forgot-password endpoint that allows users to request a password reset via email (resolves Implement Forgot Password Endpoint #25)
• Generates a cryptographically secure reset token (SHA-256 hashed) with a 1-hour expiry, stored on the user document
• Sends a password reset email using the existing sendEmail service and passwordResetTemplate
• Always returns HTTP 200 with a generic message regardless of whether the email exists, preventing user enumeration attacks
• Adds FRONTEND_URL to .env.example for constructing the reset link

Changes

File	Change
src/controllers/auth.controller.js	Added forgotPassword controller with token generation, hashing, and email dispatch
src/routes/auth.routes.js	Registered POST /forgot-password route with validation
src/validators/auth.validators.js	Added forgotPasswordSchema (validates email in request body)
.env.example	Added FRONTEND_URL environment variable

Test plan

• Send POST /api/auth/forgot-password with a registered email — verify 200 response and email received with valid reset link
• Send POST /api/auth/forgot-password with a non-existent email — verify 200 response with same generic message (no user enumeration)
• Send POST /api/auth/forgot-password with invalid email format — verify 400 validation error
• Verify the reset token in the database is SHA-256 hashed (not plaintext)
• Verify the token expires after 1 hour
• Use the token from the email with PATCH /api/auth/reset-password/:token to confirm the full flow works end-to-end

Closes #25

[ayshadogo]

@JamesVictor-O

Please resolve conflicts

[JamesVictor-O]

@ayshadogo done, please check it out