I would go for a reverse proxy to get ssl running.
https://jellyfin.org/docs/general/networking/#running-jellyfin-behind-a-reverse-proxy
Handling users with forgotten passwords is, sadly, a manual chore for the administrator.
https://jellyfin.org/docs/general/server/users/adding-managing-users#profile