Add one-time password recovery flow

SovereignAI-Starter/app/database.py

@@ -71,6 +71,15 @@ def initialize_database() -> None:
             CREATE INDEX IF NOT EXISTS idx_auth_sessions_user
                 ON auth_sessions(user_id, expires_at);
 
+            CREATE TABLE IF NOT EXISTS password_reset_tokens (
+                token_hash TEXT PRIMARY KEY,
+                user_id TEXT NOT NULL REFERENCES users(id) ON DELETE CASCADE,
+                expires_at INTEGER NOT NULL,
+                created_at TEXT NOT NULL DEFAULT CURRENT_TIMESTAMP
+            );
+            CREATE INDEX IF NOT EXISTS idx_password_reset_user
+                ON password_reset_tokens(user_id, expires_at);
+
             CREATE TABLE IF NOT EXISTS auth_rate_limits (
                 scope TEXT NOT NULL,
                 fingerprint TEXT NOT NULL,