Account recovery requires SMTP. When mail is off, treat the organization reset-password auto-enroll policy as inactive so invite/accept flows are not forced to supply a reset-password key. Fixes #7459