Add CLI flags for setup and server configuration

- Add --setup flag to create admin user
- Add --admin-user and --admin-password for setup
- Generate cryptographically random passwords for --setup
- Add --bind and --port flags for server binding
- Add BIND env var support
- Add SMTP email service for password reset
- Add password reset token storage
- Add auth header to queue/logs frontend pages
- Fix journalctl timestamp format
- Fix logs to return empty array instead of error when no entries
- Fix queue handler to return proper error message
- Hide Users/Aliases nav links when no domain selected

backend/internal/db/imc_users.go

@@ -1,5 +1,7 @@
 package db
 
+import "time"
+
 func (d *DB) GetImcUserByUsername(username string) (*ImcUser, error) {
 	var user ImcUser
 	if err := d.Preload("Domains.Domain").Where("username = ?", username).First(&user).Error; err != nil {
@@ -120,3 +122,25 @@ func (d *DB) IsUserInDomain(userID, domainID uint) (bool, error) {
 	err := d.Model(&ImcUserDomain{}).Where("user_id = ? AND domain_id = ?", userID, domainID).Count(&count).Error
 	return count > 0, err
 }
+
+func (d *DB) CreatePasswordResetToken(userID uint, token string, expiresAt time.Time) error {
+	resetToken := PasswordResetToken{
+		UserID:    userID,
+		Token:     token,
+		ExpiresAt: expiresAt,
+	}
+	return d.Create(&resetToken).Error
+}
+
+func (d *DB) GetValidPasswordResetToken(token string) (*PasswordResetToken, error) {
+	var resetToken PasswordResetToken
+	err := d.Where("token = ? AND used = false AND expires_at > ?", token, time.Now()).First(&resetToken).Error
+	if err != nil {
+		return nil, err
+	}
+	return &resetToken, nil
+}
+
+func (d *DB) MarkResetTokenUsed(token string) error {
+	return d.Model(&PasswordResetToken{}).Where("token = ?", token).Update("used", true).Error
+}