internal/alert/engine.go

@@ -186,6 +186,14 @@ func (e *Engine) handleHostOnline(ctx context.Context, hostID string) {
 //     task. The KindStaleSchedule constant is exported so UI code can
 //     reference the tag string today.
 func (e *Engine) tick(ctx context.Context, now time.Time) {
+	// User-management cleanup piggy-backed here for now. Setup tokens
+	// have a 1h expiry; the alert engine tick is the cheapest existing
+	// 60s loop. If more housekeeping queries appear, extract a
+	// dedicated maintenance loop.
+	if _, err := e.store.CleanupExpiredSetupTokens(ctx, now); err != nil {
+		slog.Warn("alert: cleanup expired setup tokens", "err", err)
+	}
+
 	hosts, err := e.store.ListHosts(ctx)
 	if err != nil {
 		slog.Warn("alert: tick list hosts", "err", err)