feat(F-099): completed feature

work/artifacts/F-099/reviewer.json

@@ -0,0 +1,13 @@
+{
+  "feature_id": "F-099",
+  "agent": "reviewer",
+  "verdict": "APPROVED",
+  "summary": "Password reset now delivers through configurable SMTP instead of logging to stdout; password change and account pages are consistent with the identity API.",
+  "evidence": [
+    "smtp-password-reset-mailer reads SMTP settings from store_settings with sane fallbacks to env vars",
+    "assertReady/isConfigured guard returns 422 EMAIL_DELIVERY_NOT_CONFIGURED instead of silently failing",
+    "PATCH /auth/me/password verifies current password before hashing the new one",
+    "Reset URL built from PUBLIC_APP_URL with trailing slash normalization"
+  ],
+  "timestamp": "2026-08-21T05:29:00Z"
+}