Sends a password-reset link to the address if an account exists for it.

The request carries the e-mail and nothing else. The tenant is resolved from the
address, server-side, exactly as sign-in already resolves it. A payload naming a tenant —
or carrying any member other than email — is refused with a
400: this operation is pre-authentication, so a tenant field would either

demand an identifier the person does not have, or become the tenant-enumeration oracle
the post-authentication tenant picker is filtered to prevent.

One link per matching account. When the address matches accounts in more than one
tenant, one reset link is sent for each. The mailbox owner learns which tenants they
belong to; the HTTP caller learns nothing, because the response does not change.

Security:

• The 202 is unconditional and its body is a fixed constant, identical for
  a match in several tenants, in exactly one, in none, and for an internal failure
  (OWASP ASVS 2.1.11). The body never echoes the submitted address
• Covered by the service-wide request rate limiter; no per-endpoint override
• Response timing is deliberately NOT equalized, and the defence does not rest on it:
  one mail per matching account costs measurably different work per match, and
  equalizing that needs real mechanism rather than an assertion
• The reset token is single-use and expires in 1 hour (configurable)

Process:

1. Validates the e-mail's shape (the only rejection this endpoint makes)
2. Resolves every active account for the address, across tenants (internal, never disclosed)
3. Generates a distinct single-use reset token per matching account
4. Publishes one reset mail per matching account
5. Returns the same generic acknowledgement whatever step 2 found