Switch to phone auth via Twilio SMS and add feature flag system

Replace email-based auth (Resend) with phone-based auth (Twilio SMS).
Add BBQ_FEATURES env var for toggling features at deploy time — when
auth is disabled, no login routes are registered and the app works
as before.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

db/queries.sql

@@ -68,3 +68,41 @@ DELETE FROM rsvps WHERE id = ?;
 
 -- name: CountRsvps :one
 SELECT COUNT(*) FROM rsvps WHERE event_id = ?;
+
+-- name: GetUserByPhone :one
+SELECT * FROM users WHERE phone = ?;
+
+-- name: CreateUser :one
+INSERT INTO users (phone, name) VALUES (?, '') RETURNING *;
+
+-- name: UpdateUserName :exec
+UPDATE users SET name = ? WHERE id = ?;
+
+-- name: CreateSession :exec
+INSERT INTO sessions (token, user_id, expires_at) VALUES (?, ?, ?);
+
+-- name: GetSession :one
+SELECT * FROM sessions WHERE token = ? AND expires_at > CURRENT_TIMESTAMP;
+
+-- name: DeleteSession :exec
+DELETE FROM sessions WHERE token = ?;
+
+-- name: DeleteExpiredSessions :exec
+DELETE FROM sessions WHERE expires_at <= CURRENT_TIMESTAMP;
+
+-- name: CreateVerificationCode :exec
+INSERT INTO verification_codes (phone, code, expires_at) VALUES (?, ?, ?);
+
+-- name: GetVerificationCode :one
+SELECT * FROM verification_codes
+WHERE phone = ? AND code = ? AND used = 0 AND expires_at > CURRENT_TIMESTAMP
+ORDER BY id DESC LIMIT 1;
+
+-- name: MarkVerificationCodeUsed :exec
+UPDATE verification_codes SET used = 1 WHERE id = ?;
+
+-- name: ListEventsByUser :many
+SELECT * FROM events WHERE user_id = ? ORDER BY created_at DESC;
+
+-- name: SetEventUser :exec
+UPDATE events SET user_id = ? WHERE id = ?;