feat: implement password reset for shop customers

Add complete password reset functionality:

Database:
- Add password_reset_tokens migration with token hash, expiry, used_at
- Create PasswordResetToken model with secure token hashing (SHA256)
- One active token per customer (old tokens invalidated on new request)
- 1-hour token expiry for security

API:
- Implement forgot_password endpoint with email lookup
- Implement reset_password endpoint with token validation
- No email enumeration (same response for all requests)
- Password minimum 8 characters validation

Frontend:
- Add reset-password.html template with Alpine.js
- Support for invalid/expired token states
- Success state with login redirect
- Dark mode support

Email:
- Add password_reset email templates (en, fr, de, lb)
- Uses existing EmailService with template rendering

Testing:
- Add comprehensive pytest tests (19 tests)
- Test token creation, validation, expiry, reuse prevention
- Test endpoint success and error cases

Removes critical launch blocker for password reset functionality.

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>

app/routes/shop_pages.py

@@ -409,6 +409,32 @@ async def shop_forgot_password_page(request: Request, db: Session = Depends(get_
     )
 
 
+@router.get(
+    "/account/reset-password", response_class=HTMLResponse, include_in_schema=False
+)
+async def shop_reset_password_page(
+    request: Request, token: str = None, db: Session = Depends(get_db)
+):
+    """
+    Render reset password page.
+    User lands here after clicking the reset link in their email.
+    Token is passed as query parameter.
+    """
+    logger.debug(
+        "[SHOP_HANDLER] shop_reset_password_page REACHED",
+        extra={
+            "path": request.url.path,
+            "vendor": getattr(request.state, "vendor", "NOT SET"),
+            "context": getattr(request.state, "context_type", "NOT SET"),
+            "has_token": bool(token),
+        },
+    )
+
+    return templates.TemplateResponse(
+        "shop/account/reset-password.html", get_shop_context(request, db=db)
+    )
+
+
 # ============================================================================
 # CUSTOMER ACCOUNT - AUTHENTICATED ROUTES
 # ============================================================================