Owner accounts: auth, password reset, CRM dashboard visibility (#19)

Flask-session login scoped to one client_id (never a request param),
self-service + operator-triggered password reset via single-use tokens,
and an Owner accounts tab on the CRM dashboard.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

backoffice/app/owner_mail.py

@@ -0,0 +1,32 @@
+"""Owner password-reset email (#19), following the same
+sender-resolution/template/mailer.send_email shape as booking_mail.py's
+booking confirmation -- see that module for why this never talks to smtplib
+directly.
+"""
+import os
+
+from flask import render_template
+
+import booking_mail
+import mailer
+
+PUBLIC_BASE_URL = os.environ.get("PUBLIC_BASE_URL", "https://onboard.mivanchenko.de").rstrip("/")
+
+
+def reset_url(token):
+    return f"{PUBLIC_BASE_URL}/owner/reset-password/{token}"
+
+
+def send_password_reset(client, user, token):
+    business_name = (client or {}).get("business_name") or "Ihr Konto"
+    html = render_template(
+        "emails/password_reset.html",
+        business_name=business_name,
+        reset_url=reset_url(token),
+    )
+    mailer.send_email(
+        user["email"],
+        f"Passwort zurücksetzen – {business_name}",
+        html,
+        from_addr=booking_mail._sender_for(client),
+    )