fix(security): add missing return after redirect in resetPassword handler

http.Redirect only sets response headers; without return, handler execution
continued with empty login/token strings, potentially causing unexpected
LDAP queries and information leakage.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

reset.go

@@ -9,6 +9,7 @@ import (
 func resetPassword(w http.ResponseWriter, r *http.Request) {
 	if len(r.URL.Query().Get("l")) == 0 || len(r.URL.Query().Get("t")) == 0 {
 		http.Redirect(w, r, "lost", http.StatusFound)
+		return
 	}
 
 	base := map[string]interface{}{