feat: implement user role status toggle and reset password functionality

- Added toggle functionality for user roles (activate/deactivate) in roles and users pages.
- Introduced a reset password page that validates and updates user passwords via a reset link.
- Enhanced user detail page with edit functionality for user information (display name, email, mobile number).
- Implemented sending reset link feature for users, with appropriate error handling and success notifications.
- Updated API endpoints for user management to support new functionalities.
- Improved UI components for better user experience during status updates and password changes.

Frontend/erp-system/lib/api/auth.ts

@@ -35,4 +35,9 @@ export const authApi = {
   refresh(): Promise<AuthSession> {
     return apiRequest<AuthSession>("/auth/refresh-token", { method: "POST", body: {} })
   },
+
+  /** Consumes a 15-minute reset-link token (from the emailed link's `?token=`) and sets a new password. */
+  resetPasswordWithToken(request: { resetToken: string; newPassword: string; confirmPassword: string }): Promise<void> {
+    return apiRequest<void>("/auth/recovery/reset-password-token", { method: "POST", body: request })
+  },
 }

Frontend/erp-system/lib/api/general-ledger.ts

@@ -245,7 +245,22 @@ export const bankAccountsApi = {
     return glRequest<CreateCashOrBankAccountResponse>("/cash-accounts", { method: "POST", body: request })
   },
 
-  // No get()/update(): GL exposes no GET/PUT by id for either bank_account or cash_account today
+  /** Rename only — the default cash account allows this too, just not delete/deactivate. */
+  updateCash(cashAccountId: number, accountName: string): Promise<CreateCashOrBankAccountResponse> {
+    return glRequest<CreateCashOrBankAccountResponse>(`/cash-accounts/${cashAccountId}`, { method: "PUT", body: { accountName } })
+  },
+
+  /** Throws (surfaced via errorMessage) if deactivating the default cash account. */
+  setCashStatus(cashAccountId: number, isActive: boolean): Promise<CreateCashOrBankAccountResponse> {
+    return glRequest<CreateCashOrBankAccountResponse>(`/cash-accounts/${cashAccountId}/status`, { method: "PATCH", body: { isActive } })
+  },
+
+  /** Throws if this is the default cash account. */
+  deleteCash(cashAccountId: number): Promise<void> {
+    return glRequest<void>(`/cash-accounts/${cashAccountId}`, { method: "DELETE" })
+  },
+
+  // No get()/update() for Bank: GL exposes no GET/PUT by id for bank_account today
   // (see docs/21-GENERAL-LEDGER-FRONTEND.md's "Known gap — edit").
 }
 

Frontend/erp-system/lib/api/users.ts

@@ -8,6 +8,8 @@ import {
   ManagedUser,
   PurgeAuthHexIdentityRequest,
   PurgeAuthHexIdentityResult,
+  SendResetLinkResponse,
+  UpdateManagedUserRequest,
   UpdateUserRoleRequest,
   UpdateUserStatusRequest,
   UserTypeOption,
@@ -38,6 +40,16 @@ export const usersApi = {
     return apiRequest<ManagedUser>(`/users/${userId}/role`, { method: "PUT", body: request })
   },
 
+  /** Edits DisplayName/Email/MobileNumber on both backends (local shadow row + AuthHex identity). */
+  update(userId: number, request: UpdateManagedUserRequest): Promise<ManagedUser> {
+    return apiRequest<ManagedUser>(`/users/${userId}`, { method: "PUT", body: request })
+  },
+
+  /** Emails the user a 15-minute password-reset link via AuthHex's forgot-password flow. */
+  sendResetLink(userId: number): Promise<SendResetLinkResponse> {
+    return apiRequest<SendResetLinkResponse>(`/users/${userId}/send-reset-link`, { method: "POST" })
+  },
+
   /** Revokes/restores standing inside ERPCore only — the auth-service credential itself is untouched. */
   updateStatus(userId: number, request: UpdateUserStatusRequest): Promise<ManagedUser> {
     return apiRequest<ManagedUser>(`/users/${userId}/status`, { method: "PATCH", body: request })