{#-
  forgot.html — request a password reset. Inherits the auth contract.
  Backend: POST /forgot -> auth.begin_reset(email) (app.py). The route responds
  identically whether or not the email exists (no account enumeration), then
  re-renders this page with a success flash -> toast.
-#}
{% extends "layout_auth.html" %}

{% block title %}Reset password{% endblock %}

{% block eyebrow %}<span class="fbb-eyebrow">Account access</span>{% endblock %}
{% block heading %}Reset your password{% endblock %}
{% block subheading %}
  <p class="fbb-muted">Enter your email and we'll send a reset link.</p>
{% endblock %}

{% block auth_body %}
  <form class="fbb-stack" method="post" action="{{ url_for('forgot') }}" data-fbb-loading data-fbb-veil>
    <input type="hidden" name="csrf_token" value="{{ csrf_token() }}">

    <div class="fbb-field">
      <label class="fbb-label" for="email">Email</label>
      <input class="fbb-input" id="email" name="email" type="email"
             autocomplete="email" required autofocus placeholder="you@example.com">
    </div>

    <button class="fbb-btn fbb-btn-primary fbb-btn-block" type="submit">
      <svg class="fbb-icon"><use href="{{ sprite }}#mail"></use></svg>
      Send reset link
    </button>
  </form>
{% endblock %}

{% block auth_foot %}
  Remembered it? <a href="{{ url_for('login') }}">Back to sign in</a>
{% endblock %}