feat: fix registration 500, add forgot-password flow, frontend validation

- Fix MissingGreenlet: sync_engine now uses psycopg2 instead of asyncpg
- Fix bcrypt/passlib compat: pin bcrypt<4.1 in requirements
- Fix legacy password_hash NOT NULL: alter column to nullable in migration
- Add frontend password validation (uppercase + lowercase + digit)
- Add forgot-password and reset-password backend endpoints
- Add forgot-password and reset-password frontend pages
- Add email_service.py (SMTP via admin settings)
- Add reset_token/reset_token_expires columns to User model
- Migrate legacy JSON-only users to DB on password reset request
- Mount data/ volume in docker-compose.local.yml for persistence
- Add production deployment config (Dockerfile, nginx, deploy.sh)

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>

frontend/next.config.ts

@@ -1,10 +1,12 @@
 import type { NextConfig } from "next";
 
-// Cible du backend pour le proxy : résolvable depuis le process Node (Next), pas depuis le navigateur.
-// En Docker Compose : http://backend:8000. En local : http://127.0.0.1:8000
+// BACKEND_URL: resolved at build time for rewrites. Must be resolvable from the container.
+// In Docker: passed as build arg (http://backend:8000). Local dev: http://127.0.0.1:8000
 const backendUrl = (process.env.BACKEND_URL || "http://127.0.0.1:8000").replace(/\/$/, "");
 
 const nextConfig: NextConfig = {
+  // Docker: standalone output for optimized production images
+  output: "standalone",
   // Turbopack ne résout pas le require() dynamique de lightningcss → "Module not found".
   // Toujours lancer avec Webpack : npm run dev ou next dev --webpack (pas "next dev" seul).
   serverExternalPackages: ["lightningcss", "@tailwindcss/postcss", "@tailwindcss/node"],