Merge remote-tracking branch 'origin/master'

svc/routes/password_forgot.go

@@ -6,9 +6,7 @@ import (
 	"bssapp-backend/internal/security"
 	"database/sql"
 	"encoding/json"
-	"fmt"
 	"net/http"
-	"os"
 	"strings"
 	"time"
 )
@@ -84,11 +82,7 @@ func ForgotPasswordHandler(
 		// -------------------------------------------------------
 		// 5️⃣ Reset URL (PLAIN token)
 		// -------------------------------------------------------
-		resetURL := fmt.Sprintf(
-			"%s/password-reset/%s",
-			os.Getenv("FRONTEND_URL"),
-			plain,
-		)
+		resetURL := security.BuildResetURL(plain)
 
 		// -------------------------------------------------------
 		// 6️⃣ Mail gönder (fail olsa bile enumeration yok)