feat(auth): add phoneNumber to profile update with SMS OTP re-verify

TEC-2722 — PATCH /api/v1/auth/profile now accepts phoneNumber alongside
fullName, avatarUrl, and email. Phone changes are deferred until the user
confirms the SMS OTP via POST /api/v1/auth/profile/verify-phone, mirroring
the existing email-change OTP flow.

- Add PhoneChangeRequestedEvent + user.phone_change_otp SMS template
- Add VerifyPhoneChangeHandler with Redis-backed 10-minute OTP
- Re-check phone uniqueness at verify time to catch races
- Extend unit tests for UpdateProfileHandler + add VerifyPhoneChangeHandler spec

Co-Authored-By: Paperclip <noreply@paperclip.ing>

apps/api/src/modules/auth/index.ts

@@ -12,4 +12,5 @@ export { UserDeactivatedEvent } from './domain/events/user-deactivated.event';
 export { UserKycUpdatedEvent } from './domain/events/user-kyc-updated.event';
 export { UserRegisteredEvent } from './domain/events/user-registered.event';
 export { EmailChangeRequestedEvent } from './domain/events/email-change-requested.event';
+export { PhoneChangeRequestedEvent } from './domain/events/phone-change-requested.event';
 export { USER_REPOSITORY, IUserRepository } from './domain/repositories/user.repository';