Sets a new password for the account the reset code belongs to, then
invalidates the code so it cannot be used again. The confirmation email sent
afterwards is best-effort: the password has already changed by then, so a
send failure is logged and the request still succeeds.

This is the /api/v1 counterpart of the legacy
PATCH /accounts/password-reset-requests route; both share the same
implementation, so behavior is identical.