Validates reset token and sets new password. Invalidates all active sessions.

Security:

• Validates single-use reset token (JWT with 1h expiration)
• Revokes all existing tokens for the user (force re-authentication)
• Password must meet strength requirements
• Token blacklisted after successful reset to prevent reuse

Process:

1. Validates reset token (signature, expiration, purpose claim)
2. Checks token hasn't been used (single-use via Redis blacklist)
3. Updates user password with secure PBKDF2 hashing
4. Revokes all active user tokens
5. Adds reset token to blacklist
6. Returns success confirmation