Add CLI flags for setup and server configuration

- Add --setup flag to create admin user
- Add --admin-user and --admin-password for setup
- Generate cryptographically random passwords for --setup
- Add --bind and --port flags for server binding
- Add BIND env var support
- Add SMTP email service for password reset
- Add password reset token storage
- Add auth header to queue/logs frontend pages
- Fix journalctl timestamp format
- Fix logs to return empty array instead of error when no entries
- Fix queue handler to return proper error message
- Hide Users/Aliases nav links when no domain selected

backend/internal/db/db.go

@@ -78,6 +78,17 @@ type ImcLoginAttempt struct {
 
 func (ImcLoginAttempt) TableName() string { return "imc_login_attempts" }
 
+type PasswordResetToken struct {
+	ID        uint      `gorm:"primaryKey" json:"id"`
+	UserID    uint      `gorm:"not null" json:"userId"`
+	Token     string    `gorm:"size:64;not null;uniqueIndex" json:"token"`
+	ExpiresAt time.Time `gorm:"not null" json:"expiresAt"`
+	Used      bool      `gorm:"default:false" json:"used"`
+	CreatedAt time.Time `json:"createdAt"`
+}
+
+func (PasswordResetToken) TableName() string { return "imc_password_reset_tokens" }
+
 type DomainStats struct {
 	ID         uint   `json:"id"`
 	Name       string `json:"name"`
@@ -160,5 +171,21 @@ func (d *DB) InitSchema() error {
 			INDEX idx_domain_id (domain_id)
 		) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4
 	`
-	return d.Exec(users2DomainsSQL).Error
+	if err := d.Exec(users2DomainsSQL).Error; err != nil {
+		return err
+	}
+
+	resetTokensSQL := `
+		CREATE TABLE IF NOT EXISTS imc_password_reset_tokens (
+			id INT UNSIGNED AUTO_INCREMENT PRIMARY KEY,
+			user_id INT UNSIGNED NOT NULL,
+			token VARCHAR(64) NOT NULL UNIQUE,
+			expires_at DATETIME NOT NULL,
+			used BOOLEAN DEFAULT FALSE,
+			created_at DATETIME DEFAULT CURRENT_TIMESTAMP,
+			INDEX idx_token (token),
+			INDEX idx_user_id (user_id)
+		) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4
+	`
+	return d.Exec(resetTokensSQL).Error
 }