Fix concurrent password reset token reuse

[rissrice2105-agent]

Summary

• atomically claim password reset tokens in a write transaction
• reject concurrent reset attempts before password/session changes
• keep password update, token invalidation, and session deletion in the same transaction

Fixes #130

Validation

• pnpm --filter @aiornot/web exec vitest run lib/auth.test.ts (5/5)
• pnpm --filter @aiornot/web test (128/128)
• pnpm --filter @aiornot/web typecheck
• pnpm --filter @aiornot/web lint (0 errors; 7 pre-existing warnings)
• git diff --check