Clean up expired verification tokens from database #233

Problem

The verification API creates pending tokens in the database when domains are claimed, but there's currently no mechanism to clean up old tokens that were never verified. This could lead to:

• Database growth over time
• Slower query performance as the tokens collection grows
• Potential confusion with multiple pending tokens for the same domain

Proposed Solution

Implement a cleanup strategy for expired verification tokens. Options to consider:

1. TTL-based cleanup: Set a reasonable expiration time (e.g., 30 days) for pending tokens
2. Periodic cleanup job: Run a background task to remove old unverified tokens
3. Database-level TTL: Use MongoDB TTL indexes to automatically expire old tokens
4. Cleanup on new claims: When claiming a domain, remove any existing pending tokens first

Implementation Considerations

• Should preserve verified tokens indefinitely
• Need to decide on appropriate token lifetime (suggested: 30-90 days)
• Consider impact on existing tokens in production
• May want to add token creation timestamps if not already present

Related

• Part of the domain verification API implementation in PR Verification API #220
• Suggested during code review by @aphansal123