Adds SMS auth endpoints

[tanatorn]

Adds the API endpoints required to actually do SMS auth, there will be a PR on the bank repo to actually do the hooking up of bank.hackclub.com to this.

Notable things:

• Adds a phone_number field to the Users object as well as a way to update it. Bank will eventually have to make API calls to add a phone number + enroll in SMS login
• We're going to be using Twilio's Verify API rather than storing our own login codes. This is better because:
  1. We don't actually have to purchase/manage phone numbers
  2. They have auto expiry/rate limits and all other good things out of the box

[tanatorn]

this isn't private so it's okay to just hardcode it here

[maxwofford]

Could you add a comment above that line that so someone doesn't put it in secrets later?

[maxwofford]

@tanatorn This is looking great. When I look at this recording, the code feels hard to read in a push-notification. Is there a way to shorten the code or add a hyphen in the middle to help mentally break it down?

[maxwofford]

Also, is the bank user going to get an sms & email at the same time? Will the codes be the same?

[tanatorn]

@maxwofford, unfortunately the text message is controlled fully by Twilio, there's nothing I can do there to change that. Additionally, it'll either go to SMS or Email. However, we don't manage any state on the SMS side, e.g. we'll generate a new user token, but we won't touch the login_codes table.

[tanatorn]

PTAL @maxwofford

[maxwofford]

This looks great! Please add the heroku env keys before merge if you haven't yet.

I have a couple questions about user experience I'll leave on the bank PR.

[tanatorn]

done!