Remove password reset functionality

Backend:
- Remove ForgotPassword API handler
- Remove password reset token model and database table
- Remove email service for sending reset emails
- Remove SMTP configuration

Frontend:
- Remove /auth/forgot page
- Remove forgot password link from login page
- Remove forgot route from auth-only routes check

backend/internal/config/config.go

@@ -39,16 +39,6 @@ type Config struct {
 
 	// Rspamd settings (spam filter)
 	RspamdAPI string // URL of the Rspamd web interface
-
-	// SMTP settings (for sending password reset emails)
-	SMTPHost     string // SMTP server hostname
-	SMTPPort     string // SMTP server port (587 for submission, 465 for SMTPS)
-	SMTPUser     string // SMTP username
-	SMTPPassword string // SMTP password
-	SMTPFrom     string // From address in outgoing emails
-
-	// Application settings
-	BaseURL string // Base URL of this application (used for generating links in emails)
 }
 
 // Load reads configuration from environment variables and .env files.
@@ -98,16 +88,6 @@ func Load() *Config {
 		// External services
 		RspamdAPI: getEnv("RSPAMD_API", "http://127.0.0.1:11334"),
 
-		// SMTP settings (for password reset emails)
-		SMTPHost:     getEnv("SMTP_HOST", "localhost"),
-		SMTPPort:     getEnv("SMTP_PORT", "587"),
-		SMTPUser:     getEnv("SMTP_USER", ""),
-		SMTPPassword: getEnv("SMTP_PASSWORD", ""),
-		SMTPFrom:     getEnv("SMTP_FROM", "noreply@localhost"),
-
-		// Application URL (for generating links in emails)
-		BaseURL: getEnv("BASE_URL", "http://localhost:8080"),
-
 		// Trusted proxies (comma-separated IPs)
 		TrustedProxies: parseTrustedProxies(getEnv("TRUSTED_PROXIES", "")),
 	}