Request a storefront customer password reset

Takes an email and ALWAYS returns 200 whether or not an account exists (no enumeration). The real work (look up the account, mint a hashed single-use short-TTL reset token, send the reset mail, audit `customer.password_reset_requested`) runs in a DETACHED worker AFTER the response, so the response latency never leaks whether the email is registered (no timing oracle). A token issued inside the five-minute per-account cooldown suppresses the duplicate mail. Behind the publishable key, the `customer_accounts` flag, spam protection, and the customer-auth rate-limit bucket. Optional `locale` selects the reset-mail language and is never rejected: any value maps to `en`, `fr`, `es`, `de` or `pt`, a regional variant to its base language (`pt-BR` gives `pt`) and any other non-empty string to English. Omitted, empty, or not a string: the site's default locale is used and mapped the same way. > **Note:** This endpoint requires the e-commerce feature to be enabled on your site.