[karlitschek]

• Resolves: #

Summary

One of seven small, independent core changes needed by a planned intrusion_detection app. Each can be reviewed and merged on its own:

1. feat(security): let apps refuse requests early with request guards #65735 – request guards: let apps refuse requests early, on every entry point
2. feat(auth): make AppPasswordCreatedEvent public and dispatch it everywhere #65736 – public AppPasswordCreatedEvent, dispatched everywhere
3. feat(auth): allow apps to invalidate a single token #65737 – IProvider::invalidateTokenById() in the public token provider
4. feat(sharing): dispatch an event when a share link access fails #65738 – ShareLinkAccessFailedEvent
5. feat(security): dispatch an event when a password reset is requested #65739 – PasswordResetRequestedEvent ← this PR
6. feat(login-flow): warn when a login flow was started from another network #65740 – login flow v2 remembers where it was started and warns on another network
7. feat(2fa): allow apps to ask for the second factor again in a session #65741 – IChallengeRequester: ask for the second factor again in a session

TODO

• Description by the author
• Manual test on a live instance

Checklist

• Code is properly formatted
• Sign-off message is added to all commits
• Tests (unit, integration, api and/or acceptance) are included
• Screenshots before/after for front-end changes
• Documentation (manuals or wiki) has been updated or is not required
• Backports requested where applicable (ex: critical bugfixes)
• Labels added where applicable (ex: bug/enhancement, 3. to review, feature component)
• Milestone added for target branch/version (ex: 32.x for stable32)

AI (if applicable)

• The content of this PR was partly or fully generated using AI

AI disclosure: this change was written with Claude Code (claude-opus-5-5) and reviewed by the author; every commit carries an Assisted-by trailer.

🤖 Generated with Claude Code