fix: CI workflow, password reset flow, health/limits in services, session refactor, dead mixin stub cleanup

backend/accounts-service/migrations/0005_password_reset_tokens.sql

@@ -0,0 +1,13 @@
+-- Single-use password reset tokens (stored hashed, like refresh tokens).
+-- A token is valid for 30 minutes; issuing a new request for the same
+-- account supersedes any token still pending from an earlier request.
+CREATE TABLE password_reset_tokens (
+    id UUID PRIMARY KEY DEFAULT gen_random_uuid(),
+    account_id UUID NOT NULL REFERENCES accounts(id) ON DELETE CASCADE,
+    token_hash TEXT NOT NULL UNIQUE,
+    expires_at TIMESTAMPTZ NOT NULL,
+    used_at TIMESTAMPTZ,
+    created_at TIMESTAMPTZ NOT NULL DEFAULT now()
+);
+
+CREATE INDEX idx_password_reset_tokens_account_id ON password_reset_tokens(account_id);