Password reset
The system stores only a hashed reset token, expires it, and marks it used after password change.
