Bind Phone Send

Mint + send an OTP to the target phone for the caller to verify.

Pre-flight rejects if the phone is already bound to a DIFFERENT user (409). Re-binding the SAME phone the caller already owns is allowed — useful as a "re-verify" affordance.

Shares the phone_otp_codes table + 60s per-phone cooldown with /api/auth/sms/send; the OTP minted here can also be consumed by that endpoint and vice versa. The /confirm endpoint below is the only thing that enforces who-owns-what at verify time, so cross- flow OTP use is benign.