add password-reset smoke test + AdminAuth DI + OneTimeToken empty-context redeem fix

app/src/OneTimeToken.php

@@ -57,8 +57,9 @@ class OneTimeToken
     }
 
     /**
-     * Redeem a token, marking it used. Returns the stored context (or null).
-     * Returns null when the token is unknown, expired, or already used.
+     * Redeem a token, marking it used. Returns the stored context (or an
+     * empty array when none was set). Returns null when the token is unknown,
+     * expired, or already used.
      *
      * @return mixed|null
      */
@@ -75,7 +76,7 @@ class OneTimeToken
         $stmt->execute([(int) $row['id']]);
 
         if ($row['context'] === null || $row['context'] === '') {
-            return null;
+            return []; // consumed successfully, no payload attached
         }
         return json_decode($row['context'], true);
     }