feat: complete admin invite and user creation and recovery flows

drizzle/schema.ts

@@ -374,3 +374,21 @@ export const invites = pgTable(
         createdAt: timestamptz("created_at").defaultNow().notNull(),
     },
 );
+
+// One-time links that let someone who forgot their password set a new one.
+// Only a hash of the token is kept, the link itself is shown once when made.
+export const recoveryLinks = pgTable(
+    "recovery_links",
+    {
+        id: text("id").primaryKey().$defaultFn(nanoid),
+        tokenHash: text("token_hash").notNull().unique(),
+        userId: text("user_id")
+            .notNull()
+            .references(() => users.id, { onDelete: "cascade" }),
+        // also turn two-factor off and sign every device out when it is used
+        resetSecurity: boolean("reset_security").notNull().default(true),
+        expiresAt: timestamptz("expires_at").notNull(),
+        createdAt: timestamptz("created_at").defaultNow().notNull(),
+    },
+    (table) => [index("recovery_links_userId_idx").on(table.userId)],
+);