This reset link is invalid or has expired — request a new one
POST /api/auth/reset-password could not use the token: unknown hash or expiresAt passed. Product: request a new one.
Why this happens
Old email reused, link already consumed, or token expired. Distinct from Invalid reset link (page opened with no token param) and from This account cannot reset its password (banned).
Diagnose and fix
1. Use forgot-password again; open only the latest email link.
2. Submit the new password promptly after opening the link.
3. If emails never arrive, fix outbound mail / password-reset template.
4. After a valid token, watch for password policy / CSRF errors instead.