feat(auth): mobile-only register/login with OTP verification

- Register and login by mobile number; email is now an optional
  contact field only (never used to authenticate)
- After registration, the phone is verified via a 6-digit SMS code
- Login supports both password and one-time-code (OTP) methods
- Phone OTP delivered via Kavenegar (verify/lookup); API key in env
- Account page: edit name/optional email, change password, and
  change mobile number with OTP re-verification
- Codes are hashed, expire in 5m, capped at 5 attempts, rate-limited
- Seed gives the admin a verified phone so mobile login still works

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

frontend/src/app/[lang]/dashboard/layout.tsx

@@ -32,6 +32,7 @@ import {
   ScrollText,
   FileText,
   Database,
+  UserCircle,
 } from 'lucide-react';
 
 type NavKey = keyof Dictionary['nav'];
@@ -46,6 +47,7 @@ const userNavItems: NavItem[] = [
   { href: '/dashboard/wallet', labelKey: 'wallet', icon: <Wallet className="w-4 h-4" /> },
   { href: '/dashboard/invoices', labelKey: 'invoices', icon: <FileText className="w-4 h-4" /> },
   { href: '/dashboard/tickets', labelKey: 'tickets', icon: <Ticket className="w-4 h-4" /> },
+  { href: '/dashboard/account', labelKey: 'account', icon: <UserCircle className="w-4 h-4" /> },
 ];
 
 const adminNavItems: NavItem[] = [
@@ -203,12 +205,17 @@ export default function DashboardLayout({ children }: { children: React.ReactNod
 
       {/* Sidebar footer */}
       <div className="pt-4 mt-4 border-t border-gray-200 shrink-0">
-        <div className="px-3 py-2">
+        <Link
+          href="/dashboard/account"
+          className="block px-3 py-2 rounded-xl hover:bg-gray-100 transition-colors"
+        >
           <p className="text-xs font-semibold text-gray-700 truncate">
             {user?.firstName} {user?.lastName}
           </p>
-          <p className="text-xs text-gray-400 truncate">{user?.email}</p>
-        </div>
+          <p className="text-xs text-gray-400 truncate" dir="ltr">
+            {user?.email || user?.phone}
+          </p>
+        </Link>
       </div>
     </div>
   );