M3 Passwort-Reset und E-Mail-Verifikation ergänzen

- Auth-Token-Tabelle mit gehashten Single-Use-Tokens einführen
- Passwort-Reset und E-Mail-Verifikation als Dev-Flow bauen
- Token-Flow-Test, Smoke-Abdeckung und M3-Dokumentation aktualisieren

passwort-zuruecksetzen.php

@@ -0,0 +1,81 @@
+<?php
+
+require_once __DIR__ . '/functions.php';
+
+$pdo = app_db_pdo();
+$token = trim((string)($_POST['token'] ?? $_GET['token'] ?? ''));
+$errors = [];
+$success = false;
+$tokenValid = $token !== '' && saas_fetch_valid_auth_token($pdo, $token, 'password_reset') !== null;
+
+if ($_SERVER['REQUEST_METHOD'] === 'POST') {
+    app_require_csrf();
+    $result = saas_reset_password_with_token(
+        $pdo,
+        $token,
+        (string)($_POST['password'] ?? ''),
+        (string)($_POST['password_confirm'] ?? '')
+    );
+
+    if ($result['ok']) {
+        $success = true;
+        $tokenValid = false;
+    } else {
+        $errors = $result['errors'];
+        $tokenValid = $token !== '' && saas_fetch_valid_auth_token($pdo, $token, 'password_reset') !== null;
+    }
+}
+
+include 'header.php';
+include 'headerline.php';
+include 'nav.php';
+?>
+
+<section id="banner">
+    <div class="content">
+        <h2>Passwort zuruecksetzen</h2>
+
+        <?php if ($success): ?>
+            <div class="hint-box success"><p>Das Passwort wurde geaendert.</p></div>
+            <ul class="actions">
+                <li><a href="login.php" class="button">Zum Login</a></li>
+            </ul>
+        <?php else: ?>
+            <?php if ($errors !== []): ?>
+                <div class="hint-box error">
+                    <?php foreach ($errors as $error): ?>
+                        <p><?php echo saas_html($error); ?></p>
+                    <?php endforeach; ?>
+                </div>
+            <?php elseif (!$tokenValid): ?>
+                <div class="hint-box error"><p>Der Link ist ungueltig oder abgelaufen.</p></div>
+            <?php endif; ?>
+
+            <?php if ($tokenValid): ?>
+                <form method="post" action="passwort-zuruecksetzen.php">
+                    <?php echo app_csrf_field(); ?>
+                    <input type="hidden" name="token" value="<?php echo saas_html($token); ?>">
+                    <div class="row">
+                        <div class="col-6 col-12-small">
+                            <label for="password">Neues Passwort</label>
+                            <input type="password" name="password" id="password" minlength="8" required>
+                        </div>
+                        <div class="col-6 col-12-small">
+                            <label for="password_confirm">Passwort wiederholen</label>
+                            <input type="password" name="password_confirm" id="password_confirm" minlength="8" required>
+                        </div>
+                    </div>
+                    <ul class="actions">
+                        <li><button type="submit">Passwort speichern</button></li>
+                    </ul>
+                </form>
+            <?php else: ?>
+                <ul class="actions">
+                    <li><a href="passwort-vergessen.php" class="button">Neuen Link anfordern</a></li>
+                </ul>
+            <?php endif; ?>
+        <?php endif; ?>
+    </div>
+</section>
+
+<?php include 'footer.php'; ?>