extract shared OneTimeToken model for single-use tokens + AdminAuth reset API

app/storage/schema.sql

@@ -281,6 +281,25 @@ CREATE TABLE IF NOT EXISTS file_access_audit (
     FOREIGN KEY (request_id) REFERENCES file_access_requests(id) ON DELETE CASCADE
 );
 
+-- Generic single-use, expiring tokens (password reset, etc.).
+-- Only the SHA-256 hash of a token is stored — never the plaintext.
+CREATE TABLE IF NOT EXISTS one_time_tokens (
+    id INTEGER PRIMARY KEY AUTOINCREMENT,
+    purpose TEXT NOT NULL,
+    token_hash TEXT NOT NULL,
+    context TEXT,
+    expires_at DATETIME NOT NULL,
+    is_valid INTEGER NOT NULL DEFAULT 1,
+    used_at DATETIME DEFAULT NULL,
+    created_at DATETIME DEFAULT CURRENT_TIMESTAMP
+);
+
+CREATE INDEX IF NOT EXISTS idx_one_time_tokens_purpose_hash
+    ON one_time_tokens(purpose, token_hash);
+
+CREATE INDEX IF NOT EXISTS idx_one_time_tokens_expires_at
+    ON one_time_tokens(expires_at);
+
 CREATE TABLE IF NOT EXISTS form_help_blocks (
     key TEXT PRIMARY KEY,
     content TEXT NOT NULL DEFAULT '',