USP Bridge: Add forgot password (recovery key) API endpoints

[AustinChangLinksys]

Problem

The USP firmware currently does not support the "Forgot Password" flow. Users cannot reset their router password using the recovery key through the USP bridge API.

Current State

• Recovery key exists in UCI: devinfo.info.recovery_key (e.g., '67048')
• The /www/cgi-bin/auth.cgi only supports login/logout/refresh, no password reset endpoints
• JNAP had VerifyRouterResetCode + SetAdminPassword3 for this flow

Required APIs

1. Verify Recovery Key

POST /api/v1/auth/verify-recovery-key
Content-Type: application/json

{
  "recovery_key": "67048"
}

Success Response:

{
  "success": true,
  "reset_token": "temporary-token-for-password-reset"
}

Error Response:

{"error": "Invalid recovery key", "error_code": 1}
{"error": "Too many attempts", "error_code": 2}

2. Reset Password (requires valid reset_token)

POST /api/v1/auth/reset-password
Content-Type: application/json

{
  "reset_token": "temporary-token-for-password-reset",
  "new_password": "newSecurePassword123"
}

Success Response:

{"success": true}

Error Response:

{"error": "Invalid or expired reset token", "error_code": 1}

Security Considerations

• Recovery key verification should have rate limiting (prevent brute force)
• Reset token should be short-lived (e.g., 5 minutes)
• Reset token should be single-use

Reference

• Recovery key location: uci get devinfo.info.recovery_key
• Related UI: lib/page/login/views/local_router_recovery_view.dart

Labels

blocked:fw-support, auth