Recover access without mixing auth into portfolio operations.

Request a reset email, then set a new password here when the recovery link opens the app. This keeps access recovery separate from portfolio views, funding requests, and withdrawal operations.