`POST /account/forgot-password`. Unauthenticated. Always returns 202 — the response shape is identical whether the email matches a real user, matches a federated user, or matches nothing. Anti-enumeration is the whole point: callers learn nothing from the response except "we accepted your request".

Targets a single user identified by `(auth.org_id, path id)`, kills their existing Cognito password with a random plaintext the admin never sees, and emails a fresh setup link so the user can pick a new one. Different from `POST /account/forgot-password` in two ways: 1. The admin is the actor; the target user might not know it happened until they read the email. We therefore use a distinct email copy (`SetupFlow::AdminPasswordReset`) that tells the user their old password is dead, not "you can ignore this and keep using your old one." 2. The endpoint is admin-only and not anti-enumeration: the admin can already enumerate their own org's users via `GET /users`, so opaque error responses would add nothing. Returns: - `200 { userId, sentTo, resetAt }` on success. - `400` if the target is a federated or app user (federated → "use your IdP"; service → "no password"). - `403` if the caller is not an admin. - `404` if the target user doesn't exist in the caller's org. - `500` if the org row, Cognito pool, or signing key are missing — these are operator-visible misconfigs, not user errors.