fix(core): prevent account enumeration and spam during password reset

[boazy]

This PR addresses two security and operational issues in the password reset flow:

1. Account Enumeration: Consistently reports "code sent" (204 No Content) regardless of account existence, preventing attackers from identifying valid users.
2. Spam Prevention: Only triggers actual message delivery via connectors if the identifier (email/phone) is registered in the system. This prevents Logto from being used as a spam relay.

Changes:

• Added user existence checks in both additionalRoutes and Experience API sendCode helper.
• For ForgotPassword events, if the user doesn't exist, we skip sending the message but still return 204 No Content.
• Added an audit log entry (userExists: false) for these non-delivery attempts to help identify potential enumeration attacks.

[github-actions]

COMPARE TO master

Total Size Diff 📈 +1.22 KB

Diff by File

Name	Diff
packages/core/src/routes/experience/verification-routes/verification-code-helpers.ts	📈 +506 Bytes
packages/core/src/routes/experience/verification-routes/verification-code.ts	📈 +34 Bytes
packages/core/src/routes/interaction/additional.ts	📈 +707 Bytes