email-based password reset

[slingamn]

If email verification is enabled, we save the email address in the database. We could use this to do automated password resets.

[slingamn]

This will need rate limiting (it would probably help to look up the best practices for this).

[clukawski]

I'll tackle this, np

[slingamn]

Notes:

1. There should be a config option to enable/disable this (something under accounts)
2. The sane preexisting implementation of this is Atheme's SENDPASS, which sends a code that can be used with SETPASS. Personally I find SETPASS a somewhat confusing name for this functionality; maybe RESETPASS makes more sense? (Hilariously, Anope's SETPASS just sends you your actual password over email: "This command is unavailable when encryption is enabled.")
3. Look at the existing implementation of verification emails to see how to send the email
4. Since SETPASS will cause a password hash (which is expensive), it should require a successful touch of (*Client).loginThrottle

[slingamn]

We should probably give people a way to change their email address :-\

[slingamn]

I think NICKSERV GET EMAIL and NICKSERV SET EMAIL are the best syntax for this. There are two possibilities:

1. Special-case email in nsGetHandler and nsSetHandler implementations, since it's not stored in the AccountSettings
2. Do a schema change to merge the email address (the "callback") into the AccountSettings object