Resolve an enabled account by normalized address.
Invalidate this exact token after delivery did not receive provider acceptance.
Replace any earlier token if the account's credential state is still current.
Atomically consume a valid token, replace the hash, and revoke all sessions/tokens.
Persistence boundary for the complete password-recovery credential lifecycle.