-- Einmal-Token fuer Passwort-Reset und Einladung (IAM-03, siehe
-- core-kanban/tickets/IAM-03.md). token_hash enthaelt NIEMALS den
-- Klartext-Token, nur dessen SHA-256-Hash.
CREATE TABLE password_tokens (
    id         UUID PRIMARY KEY DEFAULT gen_random_uuid(),
    user_id    UUID NOT NULL REFERENCES users(id),
    token_hash BYTEA NOT NULL UNIQUE,
    purpose    TEXT NOT NULL CHECK (purpose IN ('reset', 'invite')),
    expires_at TIMESTAMPTZ NOT NULL,
    used_at    TIMESTAMPTZ,
    created_at TIMESTAMPTZ NOT NULL DEFAULT now()
);