`POST /users/{id}/password-resets` — admin-initiated password reset.

Targets a single user identified by (auth.org_id, path id), kills their existing Cognito password with a random plaintext the admin never sees, and emails a fresh setup link so the user can pick a new one. Different from POST /account/forgot-password in two ways:

1. The admin is the actor; the target user might not know it happened until they read the email. We therefore use a distinct email copy (SetupFlow::AdminPasswordReset) that tells the user their old password is dead, not "you can ignore this and keep using your old one."
2. The endpoint is admin-only and not anti-enumeration: the admin can already enumerate their own org's users via GET /users, so opaque error responses would add nothing.

Returns:

• 200 { userId, sentTo, resetAt } on success.
• 400 if the target is a federated or app user (federated → "use your IdP"; service → "no password").
• 403 if the caller is not an admin.
• 404 if the target user doesn't exist in the caller's org.
• 500 if the org row, Cognito pool, or signing key are missing — these are operator-visible misconfigs, not user errors.

Path Parameters

Response Body

curl -X POST "https://example.com/users/string/password-resets"

{  "reset_at": "string",  "sent_to": "string",  "user_id": "string"}