Fix SMTP delivery, add password reset and user deletion

SMTP:
- Add connection/greeting/socket timeouts so a stalled Gmail
  connection no longer hangs sign-up
- Wrap sendMail in try/catch and fall back to logging the code
- Derive secure from port (465 implicit TLS vs 587 STARTTLS)
- Strip whitespace from the Gmail app password
- Document SMTP_HOST/SMTP_PORT in .env.example and environment.d.ts

Password reset (new):
- POST /(api)/auth/forgot-password emails a 6-digit code and does
  not reveal whether the address is registered
- POST /(api)/auth/reset-password validates the code, sets the new
  password, verifies the email, and signs the user in
- password_reset_codes table added to seed-db.mjs
- "Forgot password?" flow on the mobile sign-in screen

User deletion (new):
- DELETE /(api)/admin/users/[id], owner-only, blocks self-deletion
- Delete button with confirmation on the dashboard Users page

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

lib/db.ts

@@ -7,7 +7,7 @@ const pool = new Pool({
   connectionTimeoutMillis: 10_000,
 });
 
-type SqlValue = string | number | boolean | null | Date;
+export type SqlValue = string | number | boolean | null | Date;
 
 export async function sql<R extends QueryResultRow = QueryResultRow>(
   strings: TemplateStringsArray,
@@ -24,6 +24,14 @@ export async function sql<R extends QueryResultRow = QueryResultRow>(
   return result.rows;
 }
 
+export async function query<R extends QueryResultRow = QueryResultRow>(
+  text: string,
+  values: SqlValue[] = [],
+): Promise<R[]> {
+  const result = await pool.query<R>(text, values);
+  return result.rows;
+}
+
 export async function transaction<T>(
   callback: (
     tx: <R extends QueryResultRow = QueryResultRow>(