Switch to phone auth via Twilio SMS and add feature flag system

Replace email-based auth (Resend) with phone-based auth (Twilio SMS).
Add BBQ_FEATURES env var for toggling features at deploy time — when
auth is disabled, no login routes are registered and the app works
as before.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

migrate.go

@@ -7,11 +7,20 @@ import (
 )
 
 func runMigrations(database *sql.DB) {
-	_, err := database.Exec(`ALTER TABLE events ADD COLUMN description TEXT DEFAULT ''`)
-	if err != nil {
-		if strings.Contains(err.Error(), "duplicate column name") {
-			return
+	migrations := []string{
+		`ALTER TABLE events ADD COLUMN description TEXT DEFAULT ''`,
+		`ALTER TABLE events ADD COLUMN user_id INTEGER REFERENCES users(id)`,
+		`ALTER TABLE users RENAME COLUMN email TO phone`,
+		`ALTER TABLE verification_codes RENAME COLUMN email TO phone`,
+	}
+	for _, m := range migrations {
+		_, err := database.Exec(m)
+		if err != nil {
+			if strings.Contains(err.Error(), "duplicate column name") ||
+				strings.Contains(err.Error(), "no such column") {
+				continue
+			}
+			log.Printf("migration warning: %v", err)
 		}
-		log.Printf("migration warning: %v", err)
 	}
 }