Password Reset Token

A PasswordResetToken is the secret behind a "forgot password" link. When someone requests a reset, the platform stores a hashed value in tokenHash (never the raw token), tied to the account through userId, with an expiresAt deadline. Once the link is used, usedAt is stamped so the same token cannot be replayed. The createdAt time records when it was issued. Because it expires and can only be consumed once, this record keeps the reset flow safe even if an old email is later forwarded or leaked.