Fix login on legacy DBs: drop NOT NULL phone/email from verification_codes

Old prod DBs had verification_codes.phone (or email) as NOT NULL with no
default, so inserting a code via identifier-only failed silently — users
received an emailed code that was never stored, and verify always said
"Invalid or expired code." Drop the legacy columns in a migration and
stop swallowing the CreateVerificationCode error.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

migrate.go

@@ -22,6 +22,12 @@ func runMigrations(database *sql.DB) {
 		`DELETE FROM rsvps WHERE id NOT IN (SELECT MIN(id) FROM rsvps GROUP BY event_id, name COLLATE NOCASE)`,
 		// Plus-one tracking for RSVPs.
 		`ALTER TABLE rsvps ADD COLUMN plus_one INTEGER NOT NULL DEFAULT 0`,
+		// Drop legacy phone/email columns from verification_codes. They were
+		// NOT NULL with no default, so inserts using only identifier failed.
+		`DROP INDEX IF EXISTS idx_verification_codes_phone`,
+		`DROP INDEX IF EXISTS idx_verification_codes_email`,
+		`ALTER TABLE verification_codes DROP COLUMN phone`,
+		`ALTER TABLE verification_codes DROP COLUMN email`,
 		// SMS consent logging for Twilio compliance.
 		`CREATE TABLE IF NOT EXISTS sms_consents (
 			id         INTEGER PRIMARY KEY AUTOINCREMENT,