Design a secure 'forgot password' / reset-token flow resistant to token replay and account enumeration.

Generate a single-use, cryptographically random, short-lived reset token (not a predictable value), store only its HASH server-side (so a database leak doesn't expose usable tokens), and invalidate it immediately after first use or upon a new reset request. Return an identical response regardless of whether the submitted email exists, to prevent attackers from enumerating valid registered accounts via response-timing or content differences.