Support both email and phone login

Auto-detect whether the user entered an email or phone number.
Email sends via Resend, phone sends via Twilio SMS. Users table
has nullable phone and email columns; verification_codes uses a
generic identifier field.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

db/queries.sql

@@ -72,9 +72,15 @@ SELECT COUNT(*) FROM rsvps WHERE event_id = ?;
 -- name: GetUserByPhone :one
 SELECT * FROM users WHERE phone = ?;
 
--- name: CreateUser :one
+-- name: GetUserByEmail :one
+SELECT * FROM users WHERE email = ?;
+
+-- name: CreateUserByPhone :one
 INSERT INTO users (phone, name) VALUES (?, '') RETURNING *;
 
+-- name: CreateUserByEmail :one
+INSERT INTO users (email, name) VALUES (?, '') RETURNING *;
+
 -- name: UpdateUserName :exec
 UPDATE users SET name = ? WHERE id = ?;
 
@@ -91,11 +97,11 @@ DELETE FROM sessions WHERE token = ?;
 DELETE FROM sessions WHERE expires_at <= CURRENT_TIMESTAMP;
 
 -- name: CreateVerificationCode :exec
-INSERT INTO verification_codes (phone, code, expires_at) VALUES (?, ?, ?);
+INSERT INTO verification_codes (identifier, code, expires_at) VALUES (?, ?, ?);
 
 -- name: GetVerificationCode :one
 SELECT * FROM verification_codes
-WHERE phone = ? AND code = ? AND used = 0 AND expires_at > CURRENT_TIMESTAMP
+WHERE identifier = ? AND code = ? AND used = 0 AND expires_at > CURRENT_TIMESTAMP
 ORDER BY id DESC LIMIT 1;
 
 -- name: MarkVerificationCodeUsed :exec