Add security hardening, captcha login, and password reset via email

- .htaccess: HTTPS enforcement, security headers, block sensitive files
- data/.htaccess: deny all direct access to data directory
- Secure session settings (httponly, secure, strict mode, samesite)
- Rate limiting on login (10 attempts per 15 min per IP)
- Math captcha on login form (server-side validated)
- Password reset via email with token (1 hour expiry)
- Forgot password UI with reset link flow
- Email field added to user management
- Updated .gitignore for reset_tokens.json and login_attempts.json

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

style.css

@@ -79,6 +79,52 @@ body {
     font-size: 0.9rem;
 }
 
+.success-msg {
+    color: #2ecc71;
+    margin-top: 1rem;
+    font-size: 0.9rem;
+}
+
+.forgot-link {
+    display: inline-block;
+    margin-top: 1rem;
+    color: #0f3460;
+    font-size: 0.85rem;
+    text-decoration: none;
+    opacity: 0.7;
+    transition: opacity 0.2s;
+}
+
+.forgot-link:hover {
+    opacity: 1;
+    text-decoration: underline;
+}
+
+.captcha-row {
+    display: flex;
+    align-items: center;
+    gap: 0.75rem;
+    margin-bottom: 1rem;
+}
+
+.captcha-question {
+    font-size: 1.1rem;
+    font-weight: 700;
+    color: #0f3460;
+    white-space: nowrap;
+    min-width: 120px;
+    text-align: center;
+    background: #f0f2f5;
+    padding: 10px 14px;
+    border-radius: 8px;
+    letter-spacing: 1px;
+}
+
+.captcha-row input {
+    flex: 1;
+    margin-bottom: 0 !important;
+}
+
 /* Header */
 header {
     background: linear-gradient(135deg, #0f3460, #16213e);