Reverted SingleUseTokenProvider TypeScript conversion

[kevinansfield]

ref https://app.incident.io/ghost/incidents/298

Summary

• Reverts cfcb48b / Converted SingleUseTokenProvider to TypeScript #25151
• Restores the JS SingleUseTokenProvider implementation and removes the TS version
• Avoids job runtime failures where Node cannot resolve the tsx package from /home/ghost

[coderabbitai]

Walkthrough

This PR migrates the SingleUseTokenProvider from a TypeScript implementation to JavaScript, removes the members_otc_secret configuration parameter from all service instantiation points, and cleans up TypeScript-related worker-thread flags from the job service. The JavaScript implementation provides the same public API and functionality (token creation/validation, HOTP-based OTC generation/verification, HMAC-SHA256 OTC verification hashes, usage and lifetime enforcement, and database-level locking during validation). All consuming services and tests are updated to match the new import export style and removed secret parameter.

Possibly related PRs

• TryGhost/Ghost#25151: Earlier PR that introduced the TypeScript SingleUseTokenProvider and Bree TypeScript worker flags that this PR reverses.

Suggested reviewers

• allouis
• EvanHahn

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title accurately describes the main change: reverting a TypeScript conversion of SingleUseTokenProvider back to JavaScript implementation.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Description check	✅ Passed	The PR description is directly related to the changeset, clearly referencing a revert of a previous commit and explaining the rationale for restoring the JS implementation and removing the TS version due to job runtime failures.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch revert-single-use-token-provider-ts

---

_{Comment @coderabbitai help to get the list of available commands and usage tips.}