feat(auth): mobile-only register/login with OTP verification

- Register and login by mobile number; email is now an optional
  contact field only (never used to authenticate)
- After registration, the phone is verified via a 6-digit SMS code
- Login supports both password and one-time-code (OTP) methods
- Phone OTP delivered via Kavenegar (verify/lookup); API key in env
- Account page: edit name/optional email, change password, and
  change mobile number with OTP re-verification
- Codes are hashed, expire in 5m, capped at 5 attempts, rate-limited
- Seed gives the admin a verified phone so mobile login still works

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

frontend/src/types/index.ts

@@ -1,6 +1,8 @@
 export interface User {
   id: string;
-  email: string;
+  phone?: string | null;
+  email: string | null;
+  phoneVerified?: boolean;
   firstName: string;
   lastName: string;
   role: 'user' | 'admin' | 'technical' | 'sales';