[argszero]

Summary

Section 6 of docs/architecture.md groups the auth routes under their shared
POST /api/auth/ prefix and named six of the seven. The missing one is
reset-password, and it is the half that makes password recovery work at all.

Route	In the roster before	What it needs
forgot-password	yes	nothing — mails a code
reset-password	no	email + that code + new password
change-password	yes	a Bearer session and the old password

So the roster described a flow that stops one step short: a reader could see
how to request a code and had no listed route to submit it. The only password
route named at that point requires being logged in and remembering the current
password — precisely what someone who has forgotten theirs does not have. The
shipped UI already calls /api/auth/reset-password
(ui/js/app.js:4220), so this was documentation lagging the product, not a
dead endpoint.

Changes

• docs/architecture.md:82 — reset-password added to the auth roster,
  placed directly after forgot-password so the send-code and submit-code
  pair reads adjacently
• One entry added and nothing else: the section preamble says the table is
  a functional overview, not a per-route inventory, so the fix closes the
  recovery face without turning the table into something it disclaims
• No other carrier needed the same edit — ui/README.md:899 already names
  reset-password alongside change-password

Related Issue

None. This is a documentation correction: the roster omitted one step of a
functional face the section itself covers.

Tests

• cargo test — 579 passed, 0 failed
• cargo fmt --check — clean
• No new unit test: this changes no code. deploy_gate.rs:120 states
  outright that it does not cover docs/architecture.md (prose mention,
  not in its FILES), and no other gate parses this table
• Verified against the source rather than the prose: reset_password takes
  no AuthUser (src/routes/mod.rs:502), change_password does
  (src/routes/mod.rs:607), and both are registered in router()