feat: consolidate auth into NocoDB, add password reset, health check

- Migrate auth credentials from SQLite (auth.db) to NocoDB Users table
  with one-time migration function (auth.db → auth.db.bak)
- Add email-based password reset via Cloudron SMTP (nodemailer)
- Add GET /api/health endpoint for monitoring
- Add startup env var validation with clear error messages
- Strip sensitive fields (password_hash, reset_token) from all API responses
- Add ForgotPassword + ResetPassword pages with i18n (en/ar)

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

client/src/i18n/en.json

@@ -310,6 +310,25 @@
   "login.subtitle": "Sign in to continue",
   "login.forgotPassword": "Forgot password?",
   "login.defaultCreds": "Default credentials:",
+  "forgotPassword.title": "Forgot Password",
+  "forgotPassword.subtitle": "Enter your email to receive a reset link",
+  "forgotPassword.emailPlaceholder": "your@email.com",
+  "forgotPassword.submit": "Send Reset Link",
+  "forgotPassword.sending": "Sending...",
+  "forgotPassword.success": "If an account with that email exists, a reset link has been sent.",
+  "forgotPassword.backToLogin": "Back to Login",
+  "forgotPassword.error": "Something went wrong. Please try again.",
+  "resetPassword.title": "Reset Password",
+  "resetPassword.subtitle": "Enter your new password",
+  "resetPassword.newPassword": "New Password",
+  "resetPassword.confirmPassword": "Confirm Password",
+  "resetPassword.submit": "Reset Password",
+  "resetPassword.resetting": "Resetting...",
+  "resetPassword.success": "Password has been reset. You can now log in.",
+  "resetPassword.invalidToken": "Invalid or expired reset link.",
+  "resetPassword.goToLogin": "Go to Login",
+  "resetPassword.passwordMismatch": "Passwords do not match",
+  "resetPassword.error": "Failed to reset password. The link may have expired.",
   "comments.title": "Discussion",
   "comments.noComments": "No comments yet. Start the conversation.",
   "comments.placeholder": "Write a comment...",