- Introduced a new password‑reset flow where users submit their username/email and receive a reset link via email.
- Deprecated the old flow (enter new password then confirm via email); it’s unavailable for new tenants and should be disabled by existing tenants.