Bind Phone Confirm

Verify OTP + write phone to the caller's user row.

Mirrors /api/auth/sms/login's OTP verification (expiry, max attempts, constant-time compare) but updates the existing row instead of creating one. The phone_verified_at column is bumped to the current UTC stamp so cross-region sync's newest-wins treats this as the authoritative state.

Returns the updated public-user shape — same as /api/auth/me — so the SPA can refresh its Pinia store without a separate fetch.