feat(oauth): support password reset from OAuth flows