Initial commit of Descrybe v2 without local scratch artifacts.

Drop one-shot tmp/axe scripts and agent i18n scratch so the Gitea tree is deployable.

apps/api/sql/schema/041_password_reset_tokens.sql

@@ -0,0 +1,20 @@
+-- +goose Up
+-- Self-serve forgot-password: durable hashed one-time reset tokens (not must_set_password / invites).
+
+CREATE TABLE password_reset_tokens (
+  id UUID PRIMARY KEY DEFAULT gen_random_uuid(),
+  user_id UUID NOT NULL REFERENCES users(id) ON DELETE CASCADE,
+  token_hash TEXT NOT NULL,
+  expires_at TIMESTAMPTZ NOT NULL,
+  consumed_at TIMESTAMPTZ,
+  created_at TIMESTAMPTZ NOT NULL DEFAULT now(),
+  CONSTRAINT password_reset_tokens_token_hash_len CHECK (char_length(token_hash) = 64)
+);
+
+CREATE UNIQUE INDEX password_reset_tokens_token_hash_uidx ON password_reset_tokens (token_hash);
+CREATE INDEX password_reset_tokens_user_pending_idx
+  ON password_reset_tokens (user_id, expires_at DESC)
+  WHERE consumed_at IS NULL;
+
+-- +goose Down
+DROP TABLE IF EXISTS password_reset_tokens;