feat: expand admin and instructor tools

server/migrations/004_account_access_tokens.sql

@@ -0,0 +1,15 @@
+create type account_token_purpose as enum ('invitation', 'password_reset');
+
+create table account_access_tokens (
+  id uuid primary key default gen_random_uuid(),
+  email text not null,
+  role user_role not null default 'student',
+  purpose account_token_purpose not null,
+  token_hash text not null unique,
+  expires_at timestamptz not null,
+  used_at timestamptz,
+  created_by uuid not null references users(id),
+  created_at timestamptz not null default now()
+);
+
+create index account_access_tokens_lookup_index on account_access_tokens (token_hash) where used_at is null;