feat(ops): phase 8 — data migration scripts + fix password_reset_tokens in schema.sql

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

db/schema.sql

@@ -478,6 +478,21 @@ VALUES
   ('00000000-0000-0000-0000-000000000012'::UUID, '00000000-0000-0000-0000-000000000001'::UUID, 'Loading Bay',   'scw1-loading-bay-qr-2026')
 ON CONFLICT (id) DO NOTHING;
 
+-- ---------------------------------------------------------------------------
+-- Password reset tokens (Phase 3 — custom auth)
+-- ---------------------------------------------------------------------------
+
+CREATE TABLE IF NOT EXISTS password_reset_tokens (
+  id          UUID        PRIMARY KEY DEFAULT gen_random_uuid(),
+  user_id     UUID        NOT NULL REFERENCES users(id) ON DELETE CASCADE,
+  token_hash  TEXT        NOT NULL UNIQUE,
+  expires_at  TIMESTAMPTZ NOT NULL,
+  used_at     TIMESTAMPTZ,
+  created_at  TIMESTAMPTZ NOT NULL DEFAULT now()
+);
+
+CREATE INDEX IF NOT EXISTS password_reset_tokens_user_id_idx ON password_reset_tokens(user_id);
+
 -- Seed: app_settings (final state after all migrations)
 INSERT INTO app_settings (key, value) VALUES
   ('DEEPSEEK_API_KEY',              ''),