fix: revoke stale account recovery credentials

src/api/auth.rs

@@ -856,14 +856,7 @@ async fn reset_password(
         .await
         .map_err(|err| AppError::new(ErrorCode::Internal, "更新密码失败").with_source(err))?;
 
-    sqlx::query(
-        "UPDATE password_resets SET used_at = $2 WHERE token_hash = $1 AND used_at IS NULL",
-    )
-    .bind(token_hash)
-    .bind(now)
-    .execute(&mut *tx)
-    .await
-    .map_err(|err| AppError::new(ErrorCode::Internal, "更新重置记录失败").with_source(err))?;
+    credentials::invalidate_account_recovery(&mut tx, user_id, now).await?;
 
     tx.commit()
         .await