Native uses the same forgot API

iOS ResetPasswordFlow and Android splash forgot call POST /api/v1/auth/forgot. They show the same generic copy. They do not mint a Keychain or EncryptedPrefs session from this POST.

GET /api/v1/forgot?q= lists these topics in-app. Impersonation stays web-only.