Forgot passwordRules
The form never leaks a reset code
POST always returns the generic message. It does not reveal whether the email exists.
Kumir never invents a successful token leak. POST /api/auth/forgot and POST /api/v1/auth/forgot always return the same generic message. Unknown emails do not 404.
Playwright may receive a code only when PLAYWRIGHT=1. Production never returns the code.