Fix password recovery flow (EN-1116)

Problem

The account/password recovery flow was broken end-to-end. After clicking a
recovery email link, Kratos drops the user into a settings flow to set a new
password — but the dashboard had nowhere to handle it:

• settings_ui_url pointed at /dashboard/account, which is gated behind an
  e2b_session (Hydra token) that doesn't exist yet during recovery — so the
  user couldn't actually reach the password form.
• The reauth login screen's "Forgot password?" link started recovery directly,
  but the user already holds a Kratos session there, so Kratos bounced them with
  "already logged in" instead of starting recovery.

Changes

New shell-less /settings page (layout.tsx, page.tsx, settings-cards.tsx)

• Renders the Ory settings flow, but needs only a Kratos session (reads
  session/identity via getSettingsFlow + getUserProfile, not e2b_session),
  so the post-recovery reset works before any Hydra token exists.
• No sidebar/team chrome — just an "Account" header with a sign-out button.
• The Ory password method is rendered as dashboard-themed cards (the <Settings>
  default body is unstyled without the Ory theme stylesheet, which we never load).
  Name/e-mail are shown read-only for reference; profile editing stays on the
  gated /dashboard/account.
• On success, a non-dismissable dialog takes over (suspends Ory's default
  continue_with reload) and routes the user to sign in with the new password.