Tech debt: cleanup job for the users domain

Tracked in `roadmap.md` *Tech debts* as: **"cleanup job for users domain"**

The `users/` track accumulates rows that expire but are never reclaimed — sessions past their expiry, unconfirmed accounts, spent or stale password-reset tokens. Nothing prunes them today.

Needs a decision on the mechanism: a scheduled job (which would want the background-worker pack), a `gonext`-invoked task, or plain SQL run on a cron outside the app.

Start with roadmap.md and inspect the users/ track to identify the expired sessions, unconfirmed accounts, and stale password-reset tokens described in the issue. First decide whether cleanup belongs in a scheduled background-worker job, a gonext-invoked task, or external SQL cron; done means the mechanism and cleanup scope are defined.

Written by the indexing model from the issue text.