db: users + password_tokens migration

Adds users (citext email, nullable password_hash so a user can be
invited before claiming) and password_tokens (hashed one-shot tokens
for initial-set and reset, with purpose + TTL + used_at).

Token raw values live only in the email body; the DB stores SHA256
of the token so a DB leak doesn't grant account access.

db/migrations/002_users_and_password_tokens.rb

@@ -0,0 +1,25 @@
+Sequel.migration do
+  change do
+    create_table(:users) do
+      primary_key :id, type: :Bignum
+      column   :email,          :citext, null: false, unique: true
+      String   :name,           null: false
+      String   :password_hash
+      DateTime :last_login_at
+      DateTime :deactivated_at
+      DateTime :created_at,     null: false
+    end
+
+    create_table(:password_tokens) do
+      primary_key :id, type: :Bignum
+      foreign_key :user_id, :users, type: :Bignum, null: false, on_delete: :cascade
+      String   :token_hash, null: false, unique: true
+      String   :purpose,    null: false
+      DateTime :expires_at, null: false
+      DateTime :used_at
+      DateTime :created_at, null: false
+
+      index [:user_id, :used_at]
+    end
+  end
+end