Atomically claims a reset token by marking it used when still valid.
Plaintext URL-safe reset token.
Reference time for expiry comparison.
Consumption timestamp to persist.
The claimed token record; null when already used, expired, or missing.
Atomically claims a reset token by marking it used when still valid.