Allow {{ .Token }} (OTP) in the password reset template on free tier for mobile apps

Problem Since the change on 3 June 2026, free-tier projects using the default email provider can no longer edit their auth email templates. The password reset template is locked to {{ .ConfirmationURL }} (a link), and there's no way to switch it to {{ .Token }} (the 6-digit OTP) without setting up a custom SMTP provider — which in turn requires a verified domain. Why this matters for mobile For mobile apps, a confirmation link is a poor UX. The user has to leave their email client, open a link, and rely on deep linking to get back into the app — which is fragile and frequently breaks across email clients and OS versions. A 6-digit code is far better: the user just reads it and types it into the app. It's faster, more reliable, and it's the pattern users already expect from mobile authentication. The locked link-only default is essentially a web-first flow that doesn't serve mobile developers well. Request Would you consider allowing the {{ .Token …