feat(register/onboard): real phone OTP verification via Twilio (SDK 0.2.6)

Replaces the mock verify step (which accepted any 6 digits) with a real SMS
OTP: addPhone() → Supabase/Twilio texts a code → verifyPhone() confirms it.

- Registration creates the auth account when leaving the Account step, so the
  phone can be attached + verified against a live Supabase session; finish()
  no longer double-registers.
- Onboarding gains a real phone-verify step (Profile → Verify → Address).
- Email is trusted without an OTP in both flows (Supabase auto-confirms on
  signup; Google verifies for onboarding), matching project config.
- Bump @abe-kap/appshell-sdk to ^0.2.6.

package-lock.json

@@ -8,7 +8,7 @@
       "name": "lynkeduppro-crm",
       "version": "0.1.0",
       "dependencies": {
-        "@abe-kap/appshell-sdk": "^0.2.5",
+        "@abe-kap/appshell-sdk": "^0.2.6",
         "clsx": "^2.1.1",
         "lucide-react": "^1.21.0",
         "next": "16.2.9",
@@ -28,9 +28,9 @@
       }
     },
     "node_modules/@abe-kap/appshell-sdk": {
-      "version": "0.2.5",
-      "resolved": "https://npm.pkg.github.com/download/@abe-kap/appshell-sdk/0.2.5/76bddffe21164d833c4a63adbb6409930dbc1356",
-      "integrity": "sha512-iHkdtkUs+sgiEY+2xbQDlm9WOtEbrbB0Z/YoiBZrXM64PT4+gcgFf3RPpKNSqqkVT6LzoL2mZjulFpSMCLw+fA==",
+      "version": "0.2.6",
+      "resolved": "https://npm.pkg.github.com/download/@abe-kap/appshell-sdk/0.2.6/d47293556f910a31ed189bbabab4c81022549744",
+      "integrity": "sha512-OAMY3Lhahdl8lSvsNT5uBZFZVeV2Nr0E/QDIqWErZj8Q4jbysHLNnF0/ra/yrmNfVSZg3wPtV5OADVG67r6jqA==",
       "license": "MIT",
       "dependencies": {
         "@supabase/supabase-js": "^2.108.2",