fix: restore /reset-password-submit route

Commit 275820b added the sync-stats route by overwriting the first three
lines of reset_password_submit (decorator, def, and the uid lookup)
instead of inserting above them. That left the password reset body as
unreachable code after sync_stats() returned and unregistered the URL,
so the reset form POST returned 404.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

app.py

@@ -232,6 +232,12 @@ def sync_stats():
 
     return render_template("sync_stats.html", stats=stats)
 
+
+@app.route("/reset-password-submit", methods=["POST"])
+@login_required
+def reset_password_submit():
+    """Handle password reset form submission"""
+    uid = session.get("uid")
     new_password = request.form.get("new_password")
     confirm_password = request.form.get("confirm_password")