auth: reset links pause for a day after five (audit A3)

Security audit 2026-10-17, finding A3 (low), stage 3. sendReset spaced
reset mails ten minutes apart and capped them at five an hour per account,
so a stranger who repeated a username kept a live 30-minute link arriving
in the administrator's mailbox five times an hour, for ever.

Now five reset links a day per account (resetDayLimiter); the sixth
request sends one notice instead - "Reset links paused for a day", no
link, saying further requests are ignored for 24 hours and that a global
administrator can set a password on Server > Users - and every later one
in the window sends nothing (resetNoticeLimiter), logged either way. In
memory, like every limiter: a restart clears them.

Test: TestResetLinksPauseForADayAfterFive. Docs: security.md, guide §
Account; CHANGELOG; plan.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

docs/guide.md

@@ -605,7 +605,8 @@ Notifications go to the address either way. Only a confirmed address can be
 sent a reset link: *Forgot your password?* on the sign-in page asks for the
 username and always answers the same - whether the name exists, and whether
 its address is confirmed, is not said; another link is not sent within ten
-minutes of the last - and the link
+minutes of the last, and after five in a day the owner is mailed once that
+further requests are ignored for 24 hours - and the link
 (`https://<SELFPOST_HOSTNAME>/login/reset/…`) works once, for 30 minutes, and
 only while the account's address is still the one it was sent to. Setting the
 new password signs every session of the account out. The links name the