Forces a password reset for an already-activated user in any tenant.

Use Cases:
• User has forgotten their password and cannot access their email for self-service reset
• Security incident response: credentials may have been compromised
• Support-assisted password recovery with identity verification

What This Operation Does:

1. Sets requirePasswordChange=true on the user account
2. Generates a new activation token (valid for configured expiration period)
3. Invalidates ALL existing sessions for the user (forces logout from all devices)
4. Returns activation token to send to the user

Important: The user will NOT be able to login until they use the activation
link sent to their email address to set a new password via the Admin Console.

Difference from regenerate-activation-token:

• regenerate-activation-token: Only works for users who are ALREADY pending activation
• force-password-reset: Works for users who have ALREADY activated their account

OWASP Compliance: Follows the OWASP Forgot Password Cheat Sheet recommendation
for support-assisted password recovery with session invalidation.

Authorization:
Requires platform.users.force-password-reset scope.
Restricted to users in System Administration tenant (001).