Send a password-reset link to a user

Sends the selected user a password-reset link by email (the "Reset password" action in the detail header). The user's current password stays valid until they complete the reset through the link; no session is terminated by this command. The result records where the link was sent (masked address) and when it expires. Validation: userId must exist and be visible in scopeId (404 via ErrNotFound); the user's current state must permit a reset — SSO-managed users with no local password (lastPasswordChange null, local sign-in disabled) and INVITED users who have never set a password are rejected with 409 CONFLICT; the caller must hold owner|admin on the scope. Async & state: Synchronous — returns 200 with the reset-dispatch result; the email itself is delivered out of band. No user state changes until the link is used, at which point lastPasswordChange updates and a resource.updated SSE frame (kind iam.user, patch on lastPasswordChange) is emitted. Errors: 401 unauthenticated; 403 when the caller lacks owner|admin on the scope; 404 when scopeId/userId is unknown; 409 when the user is SSO-managed or otherwise not eligible for a local password reset; 429 when reset emails are rate-limited; 500 on dispatch failure. Idempotency/Concurrency: Idempotency-Key is optional (recommended) because the UI can retry; replaying the same key returns the original result without sending a duplicate email. Issuing a new reset link later invalidates previously issued unexpired links.