feat: implement api for "forgot password?" flow (#14915)

Relates to https://github.com/coder/coder/issues/14232

This implements two endpoints (names subject to change):
- `/api/v2/users/otp/request`
- `/api/v2/users/otp/change-password`

docs/reference/api/authorization.md

@@ -112,6 +112,72 @@ curl -X POST http://coder-server:8080/api/v2/users/login \
 | ------ | ------------------------------------------------------------ | ----------- | ---------------------------------------------------------------------------------- |
 | 201    | [Created](https://tools.ietf.org/html/rfc7231#section-6.3.2) | Created     | [codersdk.LoginWithPasswordResponse](schemas.md#codersdkloginwithpasswordresponse) |
 
+## Change password with a one-time passcode
+
+### Code samples
+
+```shell
+# Example request using curl
+curl -X POST http://coder-server:8080/api/v2/users/otp/change-password \
+  -H 'Content-Type: application/json'
+```
+
+`POST /users/otp/change-password`
+
+> Body parameter
+
+```json
+{
+	"email": "user@example.com",
+	"one_time_passcode": "string",
+	"password": "string"
+}
+```
+
+### Parameters
+
+| Name   | In   | Type                                                                                                             | Required | Description             |
+| ------ | ---- | ---------------------------------------------------------------------------------------------------------------- | -------- | ----------------------- |
+| `body` | body | [codersdk.ChangePasswordWithOneTimePasscodeRequest](schemas.md#codersdkchangepasswordwithonetimepasscoderequest) | true     | Change password request |
+
+### Responses
+
+| Status | Meaning                                                         | Description | Schema |
+| ------ | --------------------------------------------------------------- | ----------- | ------ |
+| 204    | [No Content](https://tools.ietf.org/html/rfc7231#section-6.3.5) | No Content  |        |
+
+## Request one-time passcode
+
+### Code samples
+
+```shell
+# Example request using curl
+curl -X POST http://coder-server:8080/api/v2/users/otp/request \
+  -H 'Content-Type: application/json'
+```
+
+`POST /users/otp/request`
+
+> Body parameter
+
+```json
+{
+	"email": "user@example.com"
+}
+```
+
+### Parameters
+
+| Name   | In   | Type                                                                                       | Required | Description               |
+| ------ | ---- | ------------------------------------------------------------------------------------------ | -------- | ------------------------- |
+| `body` | body | [codersdk.RequestOneTimePasscodeRequest](schemas.md#codersdkrequestonetimepasscoderequest) | true     | One-time passcode request |
+
+### Responses
+
+| Status | Meaning                                                         | Description | Schema |
+| ------ | --------------------------------------------------------------- | ----------- | ------ |
+| 204    | [No Content](https://tools.ietf.org/html/rfc7231#section-6.3.5) | No Content  |        |
+
 ## Convert user from password to oauth authentication
 
 ### Code samples

docs/reference/api/schemas.md

@@ -930,6 +930,24 @@ AuthorizationObject can represent a "set" of objects, such as: all workspaces in
 | `autostart` |
 | `autostop`  |
 
+## codersdk.ChangePasswordWithOneTimePasscodeRequest
+
+```json
+{
+	"email": "user@example.com",
+	"one_time_passcode": "string",
+	"password": "string"
+}
+```
+
+### Properties
+
+| Name                | Type   | Required | Restrictions | Description |
+| ------------------- | ------ | -------- | ------------ | ----------- |
+| `email`             | string | true     |              |             |
+| `one_time_passcode` | string | true     |              |             |
+| `password`          | string | true     |              |             |
+
 ## codersdk.ConnectionLatency
 
 ```json
@@ -4636,6 +4654,20 @@ CreateWorkspaceRequest provides options for creating a new workspace. Only one o
 | `region_id`        | integer | false    |              | Region ID is the region of the replica.                            |
 | `relay_address`    | string  | false    |              | Relay address is the accessible address to relay DERP connections. |
 
+## codersdk.RequestOneTimePasscodeRequest
+
+```json
+{
+	"email": "user@example.com"
+}
+```
+
+### Properties
+
+| Name    | Type   | Required | Restrictions | Description |
+| ------- | ------ | -------- | ------------ | ----------- |
+| `email` | string | true     |              |             |
+
 ## codersdk.ResolveAutostartResponse
 
 ```json