Spec the token module behind password resets in Go

Your Go service needs the module behind password resets. It creates a token for the reset email, then later checks the token from the link and says which user it belongs to. Other teams will reuse the module for email changes and invite links, so it has to be right once. An agent will write it.

Write the spec you would hand the agent.

What you know:

• Go 1.22 and Postgres, through database/sql
• links go out by email, and some corporate mail gateways log full URLs
• the team wants one table, auth_tokens, for every kind of token
• a token must stop working after one use or after 30 minutes

Then, in a few sentences: what does "generate a reset token and check it on use" get wrong?