-- Single-use password reset tokens (stored hashed, like refresh tokens).
-- A token is valid for 30 minutes; issuing a new request for the same
-- account supersedes any token still pending from an earlier request.
CREATE TABLE password_reset_tokens (
    id UUID PRIMARY KEY DEFAULT gen_random_uuid(),
    account_id UUID NOT NULL REFERENCES accounts(id) ON DELETE CASCADE,
    token_hash TEXT NOT NULL UNIQUE,
    expires_at TIMESTAMPTZ NOT NULL,
    used_at TIMESTAMPTZ,
    created_at TIMESTAMPTZ NOT NULL DEFAULT now()
);

CREATE INDEX idx_password_reset_tokens_account_id ON password_reset_tokens(account_id);