Add POST /auth/reset-password to confirm password reset

A new POST /auth/reset-password endpoint completes the two-step password reset flow. Previously, callers had to call Firebase’s Identity Toolkit REST API directly to exchange an oobCode for a new password. Now TIE Auth handles this as a first-class endpoint.

Request:

POST /auth/reset-password
Content-Type: application/json

{
  "oob_code": "<code from the reset email link>",
  "new_password": "NewSecurePassword123!"
}

Response (200 OK): { "status": "ok" }

New error codes:

The existing POST /auth/forgot-password endpoint is unchanged — it still sends the reset email as step 1.

See Password Reset for the full flow.