Creates a password-reset request for the account matching the supplied email
and sends the reset-link email. Always returns 201 when the request is
well-formed — even when no account matches the email — to avoid revealing
which addresses have accounts.

This is the /api/v1 counterpart of the legacy
/accounts/password-reset-requests route; both share the same
implementation, so behavior is identical.