CREATE TABLE password_reset_tokens (
  id         UUID PRIMARY KEY DEFAULT gen_random_uuid(),
  user_id    UUID NOT NULL REFERENCES users(id) ON DELETE CASCADE,
  token_hash TEXT NOT NULL UNIQUE,
  expires_at TIMESTAMPTZ NOT NULL,
  used_at    TIMESTAMPTZ,
  created_at TIMESTAMPTZ NOT NULL DEFAULT now()
);

CREATE INDEX password_reset_tokens_user_idx ON password_reset_tokens(user_id);
CREATE INDEX password_reset_tokens_hash_idx ON password_reset_tokens(token_hash);

-- password_reset_tokens: accessed via app_admin only (BYPASSRLS); no user-facing policies needed
-- GRANT already covered by: GRANT ALL ON ALL TABLES IN SCHEMA public TO app_admin