We want a behind-the-scenes security feature that regularly checks whether any of our users appear in public breach disclosures and, if so, requires a password reset and sends a clear security notice. Please build this as a Go (Gin) backend with MySQL. The service should run on a schedule, pull data from external breach feeds, and compare leaked identifiers (emails or usernames) to our user records without exposing or exporting our full user list. For matches, flag the account for a mandatory reset on the next login and write a detailed audit entry (who, when, which feed). Make the matching privacy-preserving and efficient (e.g., hashed/k-anonymized lookups), handle batching and retries for large feeds, and provide simple admin endpoints to review notifications and reset status.