Add Identity

Add email or phone to existing account.

Uses Supabase's update_user + resend flow to properly link the new identity to the current authenticated user.

A guest (anonymous session) adds a phone number here when they tap Book; verifying it turns the same Supabase user into a permanent one. When the number already belongs to another account the 409 detail is {"code": "phone_exists", "message": ...} so the web can fall back to the ordinary phone login. Each guest attempt counts against guest_flight_experience.phone_codes_per_guest_per_day (429 guest_rate_limited once over); accounts are not counted.

An email guest (gave an email at POST /auth/guest-email) sends email here to RESEND that email's confirmation code (or phone_number to add a phone); their attempts count against the same cap and a conflict carries the same coded detail. A plain guest still cannot send email: they give it at POST /auth/guest-email.