auth: publish audited password recovery

Publish the reviewed Gamertan Web Foundations v0.1.0-preview.4 snapshot with local-only administrative reset, atomic Argon2id credential replacement, mandatory rotation, all-session revocation, secret-free audit evidence, rollback coverage, and exact application-boundary guidance.

Exported from reviewed private source 403e5f6ef4d0cac683aaa76ed922236571d259a9 after trusted CI run 317 and exact Go 1.26.6 verification.

Material implementation assistance provided by OpenAI Codex; reviewed and verified through the maintainer workflow.

Signed-off-by: Cole Speelman <crspeelman@gmail.com>

docs/GETTING_STARTED.md

@@ -25,7 +25,7 @@ The packages are ordinary Go imports. Pin the current preview and verify its
 module checksum:
 
 ```bash
-go get gamertan.com/web/requestmeta@v0.1.0-preview.3
+go get gamertan.com/web/requestmeta@v0.1.0-preview.4
 go mod verify
 ```
 
@@ -67,6 +67,14 @@ adapter. Clear the browser cookie and require a fresh login after success. Do
 not treat a redirect alone as enforcement; apply the restriction before every
 protected handler.
 
+For operator-led recovery, expose `auth.ResetPassword` only through a local
+administrative command—not a public HTTP endpoint. The operation installs an
+application-generated one-time credential, sets `PasswordChangeRequired`,
+revokes every existing session, and appends a secret-free audit event in the
+same repository transaction. Deliver that credential through an exclusive
+root-owned mode-`0600` file, delete it after successful rotation, and never put
+it in command arguments, stdout, logs, manifests, or deployment state.
+
 ## Add HTML without merging responsibilities
 
 Handlers should convert request and service state into typed display data.