Make password recovery rate limit configurable with a shorter default

Password recovery requests are rate-limited to once per 15 minutes (`conf/configuration.go` defaults `SMTP.MaxFrequency` to `15 * time.Minute`, enforced in `api/recover.go:42`). This seems too restrictive for users who mistype their email or don't receive the email promptly. Consider reducing the default or making it more easily configurable per-instance.

Moved from CI 34