We return the same response whether or not the email exists.
Every link expires quickly and revokes older recovery tokens.
We accept the request without revealing whether the account exists.
If the account exists and email delivery succeeds, the inbox receives a one-time reset URL.
Password updates revoke older reset links and existing sessions automatically.