Public storefront endpoint. When called from a browser origin that is registered in the store's Storefront API allowed origins, the reset email link uses that origin as http(s)://<allowed-storefront-host>/reset-password?token=<reset-token>. Calls without an Origin header fall back to the hosted storefront custom domain and use the same /reset-password?token=... path.