Magic links: single-use tokens with stateless session cookies

A workable middle design for magic-link login is a small DB table of hashed single-use login tokens with a short expiry (e.g. 15 minutes), plus an HMAC-signed session cookie validated against the user row on each request. Fully stateless tokens cannot be single-use, so a leaked link stays valid for its whole window. A full sessions table adds a per-request lookup and pruning work. Checking is_active on the user row gives log-out-everywhere without a sessions table; what you give up is per-device logout.