fix(auth): reject password-reset tokens after they expire

[clawedassistant26]

Bug: password-reset tokens don't actually expire (up to ~24h instead of 1h)

Root cause

lib/db.ts accountForResetToken() gates the token on:

SELECT id FROM accounts WHERE reset_token = ? AND reset_expires > datetime('now')

But reset_expires is written by setResetToken() with an ISO-8601 string from Date#toISOString() (see app/api/auth/reset/route.ts: new Date(Date.now() + 60*60*1000).toISOString()), e.g. 2026-07-20T20:53:43.696Z. SQLite's datetime('now') returns a space-separated form, e.g. 2026-07-20 21:23:43.

The comparison is a lexical string comparison of two different formats. At index 10 the ISO T (0x54) always sorts after the space (0x20), so for any token whose expiry timestamp falls on the current UTC day, reset_expires > datetime('now') is always true regardless of the real time. The 1-hour expiry is defeated — a reset link stays valid for the remainder of the UTC day (up to ~24h).

Reproduction

In-memory libSQL, issue a token that expired 30 minutes ago:

process.env.TURSO_DATABASE_URL = ":memory:";
const { ensureSchema, createAccount, setResetToken, accountForResetToken } = await import("./lib/db.ts");
await ensureSchema();
const acct = await createAccount({ email: "a@b.com", passwordHash: "x", passwordSalt: "y", domain: "ex.com" });
await setResetToken("a@b.com", "TESTTOKEN", new Date(Date.now() - 30*60*1000).toISOString());
console.log(await accountForResetToken("TESTTOKEN")); // -> account id (BUG: expired token accepted)

Before the fix this returns the account id; it should return null.

Fix

Compare against an ISO "now" so it is a like-for-like comparison (ISO-8601 UTC strings sort chronologically):

... AND reset_expires > ?     -- args: [token, new Date().toISOString()]

reset_expires is only ever written as an ISO string (or NULL), so ISO-vs-ISO is correct and self-consistent. Minimal, one-query change.

Test

Adds tests/reset-token-expiry.test.mjs (in-memory libSQL): a future token is accepted, an already-expired token is rejected. It fails on the current code and passes with the fix.

Suite

node --experimental-strip-types --test tests/*.test.mjs -> 21 tests, 21 pass, 0 fail (20 existing + 1 new).