feat: member phone login — POST /public/auth/member-login + /my/login page

Returning members can now sign in with just their phone number.
The bot DMs them a 6-digit OTP; on verify a 30-day session cookie is set.
First-time users are directed to their invite link from the login page.

- Make OtpChallenge.groupId optional (migration) for re-login challenges
- Add memberLogin / memberVerify service methods
- Add POST /public/auth/member-login and /member-verify controller endpoints
- Add /api/my/login BFF route (sets tower_member_token cookie)
- Add /my/login page (phone → OTP two-step form)
- /my/* now redirects to /my/login instead of /onboard on no session

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

apps/web/app/my/layout.tsx

@@ -18,7 +18,7 @@ const NAV = [
 
 export default async function MemberLayout({ children }: { children: React.ReactNode }) {
   const token = await getMemberToken();
-  if (!token) redirect('/onboard');
+  if (!token) redirect('/my/login');
 
   return (
     <div className="flex h-full -m-6 min-h-screen">