Change Password. Logout user from all devices on change password.
Forgot Password. Logout user from all devices after resetting the password.
Register
User profile CRUD
Reset password link should expire after 2 hours by default and should be usable only once. Same for registration link. This should be mentioned in the template that is sent.
Screens/API's to design
Client-side or common:
Admin side/Settings: