Add TPIN reset via OTP, with server-clock countdowns and redacted API logs

- Reset TPIN: empty-body initiate -> OTP -> encrypted new TPIN via
  /tpin/reset/*, from a Services tile, search, and "Forgot your TPIN?"
  on the transfer's TPIN sheet (returns to the same transfer review)
- Handle every documented code: SESSION_INVALID signs out, TPIN_NOT_SET
  offers Create TPIN, CBS customer/account/org refusals stop the flow,
  outages retry from the start, expired or spent OTP/token restarts,
  policy VALIDATION_ERROR stays on the new-TPIN step
- Secrets live in screen state only and are dropped as each step ends
- Countdowns use the envelope timestamp, kept aside by the interceptor,
  so a wrong device clock cannot skew OTP or token expiry
- New TPINs refuse any three-digit run (1235, 5987), for create too
- Dev API logger redacts the session token, OTPs, PINs, encrypted
  payloads and one-time tokens
- Tests: request bodies, RSA-OAEP SHA-256 payload decrypted with Node,
  fresh nonce on key retry, server-clock deadlines, log redaction

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

src/services/api/endpoints.ts

@@ -41,11 +41,20 @@ export const endpoints = {
    * token; `createConfirm` spends that token on the new, encrypted TPIN. There
    * is no resend endpoint: a fresh `createInitiate` — MPIN and all — is the
    * resend.
+   *
+   * Resetting it follows the same three steps under `/tpin/reset`, with two
+   * differences: `resetInitiate` takes an empty body — the session alone
+   * identifies the customer, and the bank re-verifies them before the OTP goes
+   * out — and it needs a TPIN to already be active. The same session must carry
+   * all three calls; the server refuses a flow that changes user or device.
    */
   tpin: {
     createInitiate: '/tpin/create/initiate',
     createVerifyOtp: '/tpin/create/verify-otp',
     createConfirm: '/tpin/create/confirm',
+    resetInitiate: '/tpin/reset/initiate',
+    resetVerifyOtp: '/tpin/reset/verify-otp',
+    resetConfirm: '/tpin/reset/confirm',
   },
   accounts: {
     /**