Add reCAPTCHA enforcement to forgot-password reset requests

[Copilot]

Bots were able to automate password reset submissions because /forgot-password had no CAPTCHA gate on submit. This change adds reCAPTCHA validation to the forgot-password flow so reset emails are only processed after human verification.

• Controller: enforce CAPTCHA on reset request

  • Added reCAPTCHA verification in forgot_password_post before email-service and user lookup logic.
  • On failed verification, the handler returns the forgot-password form with a clear validation error.

• UI: render CAPTCHA on forgot-password form

  • Added reCAPTCHA widget to templates/password_reset/forgot.html when RECAPTCHA_SITEKEY is configured.
  • Added accessible labeling/grouping around the CAPTCHA block.

• Focused coverage

  • Added tests/test_password_reset_captcha.py to validate:
    • invalid CAPTCHA blocks processing
    • valid CAPTCHA allows normal reset-request flow

# app/controllers/password_reset.py
if not verify_recaptcha(request):
    flash('Verification failed. Please complete the challenge and try again.', FLASH_ERROR)
    return render_template('password_reset/forgot.html')

• • https://github.com/user-attachments/assets/6af6bd7e-d22b-4d04-8778-94f555825f9d