Confirm a storefront customer password reset

Consumes a single-use reset token (hashed at rest, constant-time compared, TTL and `used_at` checked in the service), sets the new scrypt password hash, marks the inbox as verified (`email_verified = true`, completing a claimed account), and bumps `customers.token_invalidated_at` so any leaked pre-reset session is revoked. The password/verification flags and token consumption commit atomically. Only a row that ALREADY has a password may be reset: a token presented for a passwordless row is rejected with the same uniform 400 as an invalid link. An invalid, expired, or already-used token returns a uniform 400 (no oracle). Behind the publishable key, the `customer_accounts` flag, and the customer-auth rate-limit bucket. Returns 200 with `{ ok: true }`. > **Note:** This endpoint requires the e-commerce feature to be enabled on your site.