add forget password

app/login/api/engine/login_otp.php

@@ -349,7 +349,7 @@ if (password_verify(trim($data["password"]), $temp["password"])) {
     // don't count so a typo in your own name doesn't eat your own attempts.
     if ($user_id) {
         $attempts = (int)($temp['login_attempts'] ?? 0) + 1;
-        if ($attempts >= 10) {
+        if ($attempts >= 5) {
             $locked_until = date('Y-m-d H:i:s', strtotime('+30 minutes'));
             $pdo1->prepare("UPDATE user SET login_attempts = :a, locked_until = :l WHERE user_id = :id")
                  ->execute([':a' => $attempts, ':l' => $locked_until, ':id' => $user_id]);
@@ -361,7 +361,7 @@ if (password_verify(trim($data["password"]), $temp["password"])) {
             $answer['message'] = "Incorrect Password";
         }
     } else {
-        $answer['message'] = "Incorrect Password";
+        $answer['message'] = "Incorrect Username";
     }
 
     setcookie("u",  "", time() - 1, "/");

app/login/api/engine/request_reset_otp.php

@@ -0,0 +1,32 @@
+<?php
+
+require '../../../session.php';
+define('UNAUTHENTICATED_ROUTE', true);
+require '../../../assets/utils/db_auth.php';
+
+// Resolve user by username or email
+$identifier = strtolower(trim($data['identifier'] ?? ''));
+
+if (!$identifier) {
+    http_response_code(422);
+    exit(json_encode(['success' => 0, 'message' => 'Please enter your username or email.']));
+}
+
+$sth = $pdo1->prepare(
+    "SELECT user_id, default_company FROM user WHERE username = :i OR email = :i LIMIT 1"
+);
+$sth->execute([':i' => $identifier]);
+$user = $sth->fetch(PDO::FETCH_ASSOC);
+
+if (!$user) {
+    http_response_code(404);
+    exit(json_encode(['success' => 0, 'message' => 'No account found with that username or email.']));
+}
+
+$user_id    = (int)$user['user_id'];
+$company_id = (int)($user['default_company'] ?? 0);
+
+require_once $include_url . 'assets/utils/classes/PasswordResetManager.php';
+
+$manager = new PasswordResetManager($pdo1, $pdo2, $include_url, $SMTP, $pinkey);
+$manager->handleRequestOtp($user_id, $company_id);

app/login/api/engine/reset_password_otp.php

@@ -0,0 +1,17 @@
+<?php
+
+require '../../../session.php';
+define('UNAUTHENTICATED_ROUTE', true);
+require '../../../assets/utils/db_auth.php';
+
+if (empty($_SESSION['reset_user_id'])) {
+    http_response_code(400);
+    exit(json_encode(['success' => 0, 'message' => 'No active reset request. Please request a new OTP.']));
+}
+
+$user_id = (int)$_SESSION['reset_user_id'];
+
+require_once $include_url . 'assets/utils/classes/PasswordResetManager.php';
+
+$manager = new PasswordResetManager($pdo1, $pdo2, $include_url, $SMTP, $pinkey);
+$manager->handleConfirmReset($user_id, $data);