feat: support phone number input for password recovery and move route to public access

apps/portal/src/app/router.tsx

@@ -70,6 +70,10 @@ export const router = createBrowserRouter([
   { path: "/set-password", element: <SetPasswordPage /> },
   { path: "/reset-password", element: <SetPasswordPage /> },
 
+  // Reached from the login page by a logged-out user, so it must stay
+  // public — ProtectedRoute would bounce them straight to the landing page.
+  { path: "/forgot-password", element: <ForgotPasswordPage /> },
+
   // Protected auth pages
   {
     element: (
@@ -79,14 +83,6 @@ export const router = createBrowserRouter([
     ),
     path: "/otp-verify",
   },
-  {
-    element: (
-      <ProtectedRoute>
-        <ForgotPasswordPage />
-      </ProtectedRoute>
-    ),
-    path: "/forgot-password",
-  },
   // The two-step setup wizard is gone. Signing up lands on the dashboard, and
   // profile details are collected where they are actually needed: on /profile,
   // via the dashboard nudge, or inline in an application flow. The path stays