feat(auth): mobile-only register/login with OTP verification

- Register and login by mobile number; email is now an optional
  contact field only (never used to authenticate)
- After registration, the phone is verified via a 6-digit SMS code
- Login supports both password and one-time-code (OTP) methods
- Phone OTP delivered via Kavenegar (verify/lookup); API key in env
- Account page: edit name/optional email, change password, and
  change mobile number with OTP re-verification
- Codes are hashed, expire in 5m, capped at 5 attempts, rate-limited
- Seed gives the admin a verified phone so mobile login still works

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

backend/src/config/configuration.ts

@@ -84,6 +84,12 @@ export default () => ({
     port: parseInt(process.env.REDIS_PORT || '6379', 10),
   },
 
+  // OTP SMS via Kavenegar (verify/lookup template API).
+  sms: {
+    kavenegarApiKey: process.env.KAVENEGAR_API_KEY || '',
+    kavenegarOtpTemplate: process.env.KAVENEGAR_OTP_TEMPLATE || '',
+  },
+
   registry: {
     /** In-cluster registry — Kaniko push and app image pull (same host). */
     url: process.env.REGISTRY_URL || 'registry.cloudhost-builds.svc.cluster.local:5000',