Switch to phone auth via Twilio SMS and add feature flag system

Replace email-based auth (Resend) with phone-based auth (Twilio SMS).
Add BBQ_FEATURES env var for toggling features at deploy time — when
auth is disabled, no login routes are registered and the app works
as before.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

schema.sql

@@ -7,6 +7,7 @@ CREATE TABLE IF NOT EXISTS events (
     location   TEXT    NOT NULL,
     admin_token TEXT   NOT NULL UNIQUE,
     description TEXT    NOT NULL DEFAULT '',
+    user_id    INTEGER REFERENCES users(id),
     created_at DATETIME NOT NULL DEFAULT CURRENT_TIMESTAMP
 );
 
@@ -35,6 +36,29 @@ CREATE TABLE IF NOT EXISTS rsvps (
     created_at DATETIME NOT NULL DEFAULT CURRENT_TIMESTAMP
 );
 
+CREATE TABLE IF NOT EXISTS users (
+    id         INTEGER PRIMARY KEY AUTOINCREMENT,
+    phone      TEXT    NOT NULL UNIQUE,
+    name       TEXT    NOT NULL DEFAULT '',
+    created_at DATETIME NOT NULL DEFAULT CURRENT_TIMESTAMP
+);
+
+CREATE TABLE IF NOT EXISTS sessions (
+    token      TEXT    PRIMARY KEY,
+    user_id    INTEGER NOT NULL REFERENCES users(id) ON DELETE CASCADE,
+    expires_at DATETIME NOT NULL
+);
+
+CREATE TABLE IF NOT EXISTS verification_codes (
+    id         INTEGER PRIMARY KEY AUTOINCREMENT,
+    phone      TEXT    NOT NULL,
+    code       TEXT    NOT NULL,
+    expires_at DATETIME NOT NULL,
+    used       INTEGER NOT NULL DEFAULT 0
+);
+
 CREATE INDEX IF NOT EXISTS idx_slots_event ON slots(event_id);
 CREATE INDEX IF NOT EXISTS idx_claims_slot ON claims(slot_id);
 CREATE INDEX IF NOT EXISTS idx_rsvps_event ON rsvps(event_id);
+CREATE INDEX IF NOT EXISTS idx_sessions_user ON sessions(user_id);
+CREATE INDEX IF NOT EXISTS idx_verification_codes_phone ON verification_codes(phone);