feat: one time password reset token

[qrkourier]

Is your feature request related to a problem? Please describe.
A forgotten password forces the user to create a new account or the admin to share a new password. There's no way for a user with a forgotten password to have a password unknown to the admin.

Describe the solution you'd like
The user contacts the admin for help. In the admin panel, the admin clicks to obtain a one-time account reset token. The token is provided to the user who uses it to authenticate and is prompted to set a new password.

Describe alternatives you've considered
Send a password reset email upon request to the account address, if it exists. The email contains a one-time password presented as a pastable token and a clickable hyperlink . The OTP is valid for a few minutes. This would work, but most people don't want to set up an SMTP account, and I reckon most open-webui instances do not represent such a large number of users that self-service is truly necessary. Though, this would serve those admins with many users.

Additional context
Account life cycle events present opportunities for external attacks and admin overreach. The privacy-oriented user will appreciate having the option to choose between optimizing for chat preservation or chat privacy. For example, the default option could be to destroy chats if the password is administratively reset, thereby removing a convenient vector for attack or admin snooping (but not all vectors).

[qrkourier]

I overlooked a feature that solves this for me. The user can reset their password after admin sets it.

It would be better if the admin set pw was single use, forcing the user to choose a new secret immediately, avoiding the persistence of a shared (compromised) secret.

The self service email method would still be useful for larger instances with many users.

[juliojesusvizcaino]

I'm working on a solution for email-based password recovery.

It is a draft, but it already works (if configured correctly). I haven't tested it in docker yet, later today.

It's currently in a fork, but I'd be happy to merge it upstream.

#2003