Generates a 64-character secure recovery token and stores it in the database
Updates the user's password hash in the database
Invalidates the token after use
Validates a recovery token. Returns the user_id if valid, nil otherwise