IAV-1070: split reset-password flow into OTP verification and new-password steps

• Added a two-step reset-password page flow:
  • Step 1 /auth/reset-password — OTP-only page using otpValidationSchema
  • Step 2 /auth/reset-password/new-password — new password form using newPasswordValidationSchema; redirects back if OTP is missing or invalid
  • Split passwordResetValidationSchema into otpValidationSchema + newPasswordValidationSchema
  • Made ResetPasswordHeader accept optional title and subtitle props for reuse across both steps
  • Created NewPasswordForm component with password strength bar, rules checklist, and success view
  • Fixed OTP input bug: String.padEnd(6, '') produced an empty array — replaced with Array.from({ length: 6 }, ...)
  • Added auth.resetPasswordNewPassword path constant
  • Exported NewPasswordForm from the component index