fix(07.2): add user_nbf write to password_reset_confirm — CR-02 gap closure

backend/api/auth.py

@@ -699,6 +699,7 @@ async def password_reset_request(
 
 @router.post("/password-reset/confirm")
 async def password_reset_confirm(
+    request: Request,
     body: PasswordResetConfirmRequest,
     session: AsyncSession = Depends(get_db),
 ):
@@ -740,6 +741,12 @@ async def password_reset_confirm(
     # Update password and revoke all sessions (forces re-auth through TOTP if enabled)
     user.password_hash = auth_service.hash_password(body.new_password)
     await auth_service.revoke_all_refresh_tokens(session, user.id)
+    # Revoke any pre-reset access tokens still within their TTL window (T-7.2-01)
+    await request.app.state.redis.set(
+        f"user_nbf:{user.id}",
+        int(time.time()),
+        ex=settings.access_token_expire_minutes * 60,
+    )
     await session.commit()
 
     # Do NOT issue tokens (AUTH-05 — user must pass TOTP gate on next login)