forgot-password: wire up an email provider (reset is a no-op in production)

[austinchima]

Problem

POST /api/auth/forgot-password generates a valid password-reset token but never delivers it in production. The token is only logged to the console in the Development environment — so in production a user who requests a reset gets the generic success message but no email, making password reset effectively non-functional.

Location: Precept.Api/Controllers/AuthController.cs:366

if (environment.IsDevelopment())
{
    // DEV ONLY: log the token so the developer can test without an email provider
    logger.LogWarning("[DEV ONLY] Password reset token for {Email}: {Token}", request.Email, token);
}

// TODO: In production, send this token via a secure email service.
// Example: await _emailService.SendPasswordResetEmail(request.Email, token);

Proposed work

• Introduce an IEmailService abstraction and a concrete provider (e.g. SendGrid / Postmark / SMTP).
• Send the reset token via a templated email containing the reset link.
• Configure provider credentials via environment variables (consistent with the existing JWT_SECRET_KEY pattern — no secrets in committed config).
• Keep the generic, enumeration-safe response unchanged ("If an account exists, a password reset email has been sent.").
• Remove the [DEV ONLY] token logging once a real provider exists (or keep it Development-gated only).
• Add an integration test covering the forgot-password → reset-password flow with a fake/mock email service.

Notes

• Not a security hole — the token is not leaked in production, the flow just doesn't complete.
• Surfaced during the production-readiness sweep in fix(ci): get the test suite green — provision Postgres, track migrations, harden JWT secret #4; intentionally left out of that PR to keep it scoped to the CI fix.

🤖 Generated with Claude Code