Handles the /reset_password.php?token=... URL generated by the
admin send_password_reset action. Flow:
- GET: validates token against pending_registrations (username=__reset__,
not expired), shows set-new-password form
- POST: re-validates token, enforces 6-char min + confirm match,
bcrypt-hashes the new password, updates users.password by email,
deletes the pending row to prevent reuse
- Invalid/expired token shows a clear error with link back to home
Matches the dark gaming aesthetic of verify.php.
