Request a new reset link without exposing whether the account exists.

The recovery flow now keeps messaging intentionally generic, throttles repeated requests, and still gives legitimate users a clear route back into their workspace.

• Generic account-discovery response
• CSRF token included in the request
• Rate limited to reduce abuse