Stored by requestPasswordReset when it emails a reset link, and read back
by resetPassword when the link is used.
token: string
The signed token itself, which the reset link carries.
user_id: string
expires_at: string
Lets db/startup.ts purge old rows. The token's own exp is what ends
the link.
used_at: string | null
Set when the link is used, and reset to null if the reset then fails.