fix: use generic account recovery response

[enlorik]

Summary

• Return the same account-recovery success message whether or not a matching account exists.
• Keep internal logs truthful for non-matching requests, sent emails, and email delivery failures.
• Add controller tests for missing account, matching account, and email delivery failure paths.

Why

This prevents the form from revealing whether a username/email pair exists while preserving useful server-side observability.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 2f8503e7e6

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

Make reset request paths indistinguishable

When POST /forgot-password gets a username/email pair that does not match an account, this branch returns immediately, while the matching-account branch calls passwordResetService.createTokenAndSendResetEmail, which creates a token and synchronously sends/retries an external email before returning. In the account-recovery flow this patch is trying to protect, a client can still distinguish valid pairs by measuring response time even though the displayed message is generic; make the missing-account path indistinguishable from the real path, e.g. by queueing email work asynchronously or doing equivalent dummy work before responding.

Useful? React with 👍 / 👎.