feat: new emails design

features/request_password_reset.feature

@@ -39,8 +39,8 @@ Feature: Anyone can request a password reset, and the response never reveals whe
       most recently requested code and expiration are ever valid; a user who requests a reset twice
       can only use the second code, and the first one no longer matches once overwritten
     And after storing succeeds, RequestPasswordReset calls mail.Repository.Send with the user's
-      email, template "passwordReset" (the already-existing
-      internal/infrastructure/mailer/templates/passwordReset.html, which renders a link from
+      email, template "password-reset" (the already-existing
+      internal/infrastructure/mailer/templates/password-reset.html, which renders a link from
       "{{.Host}}/register/reset/validate?c={{.VerificationCode}}&email={{.Email}}"), and a
       MailPasswordResetData value whose Host is the injected public URL, whose VerificationCode is
       the raw (unhashed) code, and whose Email is the user's email
@@ -69,7 +69,7 @@ Feature: Anyone can request a password reset, and the response never reveals whe
     When the client sends POST /v1/auth/password-reset with body {"email": "alice@example.com"}
     Then the response status is 200
     And the response body is {"message": "If an account exists for that email, a password reset link has been sent."}
-    And exactly one email was sent to "alice@example.com" using template "passwordReset"
+    And exactly one email was sent to "alice@example.com" using template "password-reset"
     And that email's data has VerificationCode equal to the raw code stored in the repository's
       hashed PasswordResetCode for alice, not the hash itself, and Email equal to "alice@example.com"
 
@@ -116,7 +116,7 @@ Feature: Anyone can request a password reset, and the response never reveals whe
     When the client sends POST /v1/auth/password-reset with body {"email": "bob@example.com"}
     Then the response status is 200
     And the response body is {"message": "If an account exists for that email, a password reset link has been sent."}
-    And exactly one email was sent to "bob@example.com" using template "passwordReset"
+    And exactly one email was sent to "bob@example.com" using template "password-reset"
 
   Scenario Outline: A malformed request is still rejected, since this is not an enumeration concern
     When the client sends POST /v1/auth/password-reset with body <body>
@@ -136,7 +136,7 @@ Feature: Anyone can request a password reset, and the response never reveals whe
     Then the call returns nil
     And the fake repository's UpdatePasswordResetCode method was invoked exactly once with userId 3,
       a hashed code, and an expiration within 5 seconds of time.Now().Add(1 * time.Hour)
-    And exactly one email was sent to "alice@example.com" using template "passwordReset" whose data
+    And exactly one email was sent to "alice@example.com" using template "password-reset" whose data
       carries the same raw code that was hashed, and Host "https://cms.example.com"
 
   Scenario: The use case swallows an unknown email and returns nil without touching the repository or mailer