Merge remote-tracking branch 'origin/master'

svc/routes/user_detail.go

@@ -14,7 +14,6 @@ import (
 	"io"
 	"log"
 	"net/http"
-	"os"
 	"strconv"
 	"strings"
 	"time"
@@ -462,11 +461,7 @@ func SendPasswordResetMailHandler(
 		`, userID, hash, expires)
 
 		// 🔗 URL → PLAIN
-		resetURL := fmt.Sprintf(
-			"%s/password-reset/%s",
-			os.Getenv("FRONTEND_URL"),
-			plain,
-		)
+		resetURL := security.BuildResetURL(plain)
 
 		_ = mailer.SendPasswordResetMail(email, resetURL)