feat(auth): mobile-only register/login with OTP verification

- Register and login by mobile number; email is now an optional
  contact field only (never used to authenticate)
- After registration, the phone is verified via a 6-digit SMS code
- Login supports both password and one-time-code (OTP) methods
- Phone OTP delivered via Kavenegar (verify/lookup); API key in env
- Account page: edit name/optional email, change password, and
  change mobile number with OTP re-verification
- Codes are hashed, expire in 5m, capped at 5 attempts, rate-limited
- Seed gives the admin a verified phone so mobile login still works

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

backend/src/users/entities/user.entity.ts

@@ -14,8 +14,18 @@ export class User {
   @PrimaryGeneratedColumn('uuid')
   id: string;
 
-  @Column({ unique: true })
-  email: string;
+  // Phone is the login identifier (required at registration). Email is an
+  // optional contact field only — it is never used to authenticate.
+  // Both are unique; Postgres treats NULLs as distinct, so accounts missing
+  // either coexist freely.
+  @Column({ unique: true, nullable: true })
+  phone: string | null; // canonical E.164, e.g. +989121234567
+
+  @Column({ unique: true, nullable: true })
+  email: string | null;
+
+  @Column({ default: false })
+  phoneVerified: boolean;
 
   @Column()
   password: string;