Verify the OTP and return {token, user}.

First successful verify for a phone number that has never been seen creates a new user row (phone-only signup). Subsequent verifies for that same number return the existing user.