Switch to phone auth via Twilio SMS and add feature flag system

Replace email-based auth (Resend) with phone-based auth (Twilio SMS).
Add BBQ_FEATURES env var for toggling features at deploy time — when
auth is disabled, no login routes are registered and the app works
as before.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

db/models.go

@@ -5,6 +5,7 @@
 package db
 
 import (
+	"database/sql"
 	"time"
 )
 
@@ -25,6 +26,7 @@ type Event struct {
 	Location    string
 	AdminToken  string
 	Description string
+	UserID      sql.NullInt64
 	CreatedAt   time.Time
 }
 
@@ -36,6 +38,12 @@ type Rsvp struct {
 	CreatedAt time.Time
 }
 
+type Session struct {
+	Token     string
+	UserID    int64
+	ExpiresAt time.Time
+}
+
 type Slot struct {
 	ID        int64
 	EventID   int64
@@ -44,3 +52,18 @@ type Slot struct {
 	MaxClaims int64
 	SortOrder int64
 }
+
+type User struct {
+	ID        int64
+	Phone     string
+	Name      string
+	CreatedAt time.Time
+}
+
+type VerificationCode struct {
+	ID        int64
+	Phone     string
+	Code      string
+	ExpiresAt time.Time
+	Used      int64
+}