feat: consolidate auth into NocoDB, add password reset, health check

- Migrate auth credentials from SQLite (auth.db) to NocoDB Users table
  with one-time migration function (auth.db → auth.db.bak)
- Add email-based password reset via Cloudron SMTP (nodemailer)
- Add GET /api/health endpoint for monitoring
- Add startup env var validation with clear error messages
- Strip sensitive fields (password_hash, reset_token) from all API responses
- Add ForgotPassword + ResetPassword pages with i18n (en/ar)

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

server/.env.example

@@ -0,0 +1,29 @@
+# Required
+NOCODB_URL=http://localhost:8090
+NOCODB_TOKEN=your-nocodb-api-token
+NOCODB_BASE_ID=your-base-id
+
+# Session (required in production)
+SESSION_SECRET=your-random-secret-key
+NODE_ENV=development
+
+# CORS (optional, restricts allowed origins)
+CORS_ORIGIN=http://localhost:5173
+
+# App URL for email links (optional, auto-detected from request if not set)
+APP_URL=https://your-app.example.com
+
+# SMTP for password reset emails
+# Cloudron injects these automatically when sendmail addon is enabled
+CLOUDRON_MAIL_SMTP_SERVER=
+CLOUDRON_MAIL_SMTP_PORT=587
+CLOUDRON_MAIL_SMTP_USERNAME=
+CLOUDRON_MAIL_SMTP_PASSWORD=
+CLOUDRON_MAIL_FROM=noreply@your-domain.com
+
+# Alternative SMTP config (used if CLOUDRON_MAIL_* not set)
+# MAIL_SMTP_SERVER=smtp.example.com
+# MAIL_SMTP_PORT=587
+# MAIL_SMTP_USERNAME=
+# MAIL_SMTP_PASSWORD=
+# MAIL_FROM=noreply@your-domain.com