feat(frontend): add forgot-password and reset-password pages

- /forgot-password: email form → sends POST /api/auth/forgot-password → success banner
- /reset-password: password form reads token from URL → sends POST /api/auth/reset-password
- Login page: add "Passwort vergessen?" link
- hooks.server.ts: add /forgot-password and /reset-password to PUBLIC_PATHS; skip auth
  injection for public auth API endpoints
- errors.ts: add INVALID_RESET_TOKEN error code
- i18n: add all new message keys in de/en/es
- playwright.config.ts: use E2E_BASE_URL for webServer check URL (allows reusing docker
  dev server at port 5173 locally)
- ci.yml: pass E2E_BACKEND_URL=http://localhost:8080 to E2E test step
- e2e/password-reset.spec.ts: 5 tests (4 pass locally, full flow requires e2e profile in CI)
- Regenerated OpenAPI types including new /api/auth/* endpoints

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

frontend/src/routes/login/+page.svelte

@@ -89,6 +89,14 @@ const activeLocale = $derived(getLocale().toUpperCase());
 					>
 						{m.login_btn_submit()}
 					</button>
+
+					<div class="mt-4 text-center">
+						<a
+							href="/forgot-password"
+							class="font-sans text-xs text-gray-400 transition-colors hover:text-brand-navy"
+							>{m.login_forgot_password()}</a
+						>
+					</div>
 				</form>
 			</div>
 		</div>