auth: reset links pause for a day after five (audit A3)

Security audit 2026-10-17, finding A3 (low), stage 3. sendReset spaced
reset mails ten minutes apart and capped them at five an hour per account,
so a stranger who repeated a username kept a live 30-minute link arriving
in the administrator's mailbox five times an hour, for ever.

Now five reset links a day per account (resetDayLimiter); the sixth
request sends one notice instead - "Reset links paused for a day", no
link, saying further requests are ignored for 24 hours and that a global
administrator can set a password on Server > Users - and every later one
in the window sends nothing (resetNoticeLimiter), logged either way. In
memory, like every limiter: a restart clears them.

Test: TestResetLinksPauseForADayAfterFive. Docs: security.md, guide §
Account; CHANGELOG; plan.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

docs/security.md

@@ -176,7 +176,10 @@ The panel is exposed to the internet — the items below are **not optional**.
   after answering, so neither the words nor the time tell whether a name
   exists or is confirmed; requests are limited to five in 15 minutes per
   client address and username (fifty per address alone), mails to five an
-  hour per account, and a link's page to 30 requests in 15 minutes per link
+  hour per account and five reset links a day - after which the owner is
+  told once that further requests are ignored for 24 hours, and nothing
+  more is sent (`2.14.4`; audit A3: anyone who knew a username kept a live
+  link in that mailbox five times an hour) - and a link's page to 30 requests in 15 minutes per link
   (300 per address alone), so one stranger behind a shared proxy cannot stop
   the others asking for or opening a link (`2.14.4`; audit A1). A link's page changes nothing
   on `GET` (a mail scanner opens links): the button does. Setting a password