Add comprehensive security controls to reset-password endpoint, including CAPTCHA, secure token with TTL, account lockout, dummy cookie, security question, post-reset session termination, and user notification.#1594