Confirm reset
Complete the password reset challenge and return to a protected role workspace.
Protected entry is wired for Cognito, with seeded local preview accounts when credentials are not configured.
The app opens the correct role workspace after authentication and respects multi-role account selection.