add password-reset flow: request endpoint + reset page + login link (shared OneTimeToken)

app/public/admin/request-reset.php

@@ -0,0 +1,50 @@
+<?php
+/**
+ * Request a password reset (unauthenticated).
+ *
+ * Issues a single-use reset token (shared OneTimeToken model, purpose
+ * 'password_reset') and emails the link to the admin notification address.
+ * Always returns a neutral message so an attacker cannot learn whether a
+ * password hash is configured.
+ */
+require_once __DIR__ . '/../../bootstrap.php';
+require_once APP_ROOT . '/src/AdminAuth.php';
+require_once APP_ROOT . '/src/App.php';
+require_once APP_ROOT . '/src/RateLimit.php';
+
+// Only meaningful when a password actually exists (dev mode has none).
+if (!AdminAuth::hasPassword()) {
+    header('Location: /admin/');
+    exit;
+}
+
+App::boot();
+
+if ($_SERVER['REQUEST_METHOD'] !== 'POST') {
+    http_response_code(405);
+    header('Allow: POST');
+    exit;
+}
+
+// CSRF
+if (empty($_POST['csrf_token']) || empty($_SESSION['csrf_token'])
+    || !hash_equals($_SESSION['csrf_token'], $_POST['csrf_token'])) {
+    App::flash('error', 'Erreur de sécurité : token invalide.');
+    header('Location: /admin/login.php');
+    exit;
+}
+
+// Rate-limit reset requests (3 per 10 min per IP) to prevent inbox flooding.
+$key = 'password_reset_' . ($_SERVER['REMOTE_ADDR'] ?? 'unknown');
+if (!(new RateLimit(3, 600))->checkKey($key)) {
+    App::flash('error', 'Trop de demandes. Réessayez dans quelques minutes.');
+    header('Location: /admin/login.php');
+    exit;
+}
+
+$sent = AdminAuth::requestPasswordReset();
+
+// Neutral message regardless of outcome (no information leak).
+App::flash('success', 'Si une adresse de notification est configurée, un lien de réinitialisation a été envoyé.');
+header('Location: /admin/login.php');
+exit;