Guardian confirmationConsent
The server stores a sha256 digest
hashGuardianToken is sha256 hex. The emailed code is not stored in plaintext.
GuardianConsentToken.tokenHash is sha256 hex of the emailed code. Used rows cannot be reused.
A second submit with the same code fails after usedAt is set.