feat: add Twilio OTP verification and JWT authentication

- Add phone number verification via Twilio Verify with SMS OTP
- Issue JWT tokens after successful verification (30-day expiry)
- Protect all API endpoints with auth middleware
- Rate limit OTP requests to 3 per phone per 24 hours
- Cache verified phones to skip OTP on repeat registrations
- Enforce phone number ownership on device registration
- Use authenticated phone as authoritative sender identity

Author: onamfc

server/.env.example

@@ -2,3 +2,11 @@
 DATABASE_URL=postgresql://postgres:postgres@localhost:5433/fliq
 PORT=3100
 NODE_ENV=development
+
+# Twilio Verify (OTP)
+TWILIO_ACCOUNT_SID=your_twilio_account_sid
+TWILIO_AUTH_TOKEN=your_twilio_auth_token
+TWILIO_VERIFY_SERVICE_SID=your_verify_service_sid
+
+# JWT
+JWT_SECRET=a_strong_random_secret_at_least_32_chars