Set a new passwordRules
The form never fakes a password update
Update only runs after a valid sha256 digest. It does not mint passwordHash otherwise.
Kumir never invents a successful hash swap. POST /api/auth/reset and POST /api/v1/auth/reset only update User.passwordHash after a valid sha256 digest.
A failed or expired code does not mint a new passwordHash.