Harden sync and security; add IQ Bible, templates, password reset, backups

Sync and data safety
- Autosave flushes on leaving a study or the tab; storage-full errors are reported
- Unsynced studies, deletes and ink are queued and retried when back online
- Deletes propagate across devices (with a "Keep it" undo) and no longer resurrect
- Server assigns study versions (no client-clock conflicts); "Combine both"
  merges a conflicted study chunk by chunk
- Reading-plan progress made offline is merged, not overwritten; plans, ink and
  marks are cleared from the device on sign-out

Security
- Block SSRF through the ntfy reminder URL; failure-only rate limiting per IP and
  account; constant-time login; TOTP replay protection; input validation;
  SESSION_SECRET required in production; admin user delete fixed
- Forgot password: one-time code sent to the account's ntfy topic

Features
- IQ Bible proxy (route allow-list, text-only caching per its terms): more
  commentaries, lexicons, study aids, daily verse and devotional, plan calendar
  export, narrations, podcast background
- Study templates, reading-plan catch-up, account export, daily database snapshots

Tests and tooling
- ESLint config; App tests split into src/test; tests for sync queues, library
  hook, merge, templates, IQ Bible UI and reset form

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

src/syncService.js

@@ -160,6 +160,16 @@ export async function loginUser(email, password) {
   return request('POST', '/auth/login', { email, password });
 }
 
+/** Asks for a password-reset code to be sent to the account's notification topic. */
+export async function requestPasswordReset(email) {
+  return request('POST', '/auth/forgot', { email });
+}
+
+/** Sets a new password using the code that was sent. `token` is the authenticator code, when 2FA is on. */
+export async function resetPassword({ email, code, newPassword, token }) {
+  return request('POST', '/auth/reset', { email, code, newPassword, token });
+}
+
 export async function logoutUser() {
   return request('POST', '/auth/logout');
 }