Switch to phone auth via Twilio SMS and add feature flag system

Replace email-based auth (Resend) with phone-based auth (Twilio SMS).
Add BBQ_FEATURES env var for toggling features at deploy time — when
auth is disabled, no login routes are registered and the app works
as before.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

features.go

@@ -0,0 +1,18 @@
+package main
+
+import "strings"
+
+type Features struct {
+	Auth bool
+}
+
+func parseFeatures(env string) Features {
+	var f Features
+	for _, flag := range strings.Split(env, ",") {
+		switch strings.TrimSpace(strings.ToLower(flag)) {
+		case "auth":
+			f.Auth = true
+		}
+	}
+	return f
+}