Switch to phone auth via Twilio SMS and add feature flag system

Replace email-based auth (Resend) with phone-based auth (Twilio SMS).
Add BBQ_FEATURES env var for toggling features at deploy time — when
auth is disabled, no login routes are registered and the app works
as before.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

templates/layout.html

@@ -386,6 +386,9 @@
 {{block "admin-bar" .}}{{end}}
 <header>
   <a class="logo" href="/"><span>&#127834;</span> bbq</a>
+  <nav style="font-family:'DM Mono',monospace;font-size:0.75rem;">
+    {{if .User}}<a href="/dashboard" style="color:var(--ink);text-decoration:none;margin-right:12px;">{{.User.Name}}</a><form method="POST" action="/logout" style="display:inline;"><button type="submit" style="background:none;border:none;font-family:inherit;font-size:inherit;cursor:pointer;text-decoration:underline;">log out</button></form>{{else if .AuthEnabled}}<a href="/login" style="color:var(--ink);text-decoration:underline;">log in</a>{{end}}
+  </nav>
 </header>
 <main>
 {{block "content" .}}{{end}}