GHSA-r6w9-259g-gwrv: Vikunja: Plaintext storage of password-reset/email-confirm tokens in database enables account takeover on DB

Vikunja stores password-reset, email-confirmation, and account-deletion tokens in the user_tokens table in plaintext. If an attacker gains read access to the database through a backup leak, misconfigured storage, or SQL-level exposure, they can immediately use pending tokens to take over user accounts without knowing passwords. ### Details pkg/user/token.go — genToken() stores the raw random string directly: ```go func genToken(u *User, kind TokenKind) (*Token, error) { tokenStr, err := utils.CryptoRandomString(tokenSize) ... …