fix(auth): validate verify sms phone strings

[aiirvizionz]

Summary

• reject non-string phoneNumber values before verify-sms logging or session validation
• prevent malformed phone payloads from reaching substring masking or auth work
• add regression coverage for numeric phoneNumber payloads

Test

• node node_modules\vitest\vitest.mjs run --config %TEMP%\qryptchat-vitest-minimal.config.mjs "src/app/api/auth/verify-sms/route.test.js"
• git diff --check

uGig billing

• Expected invoice: 0.50 USD if accepted/merged
• Counted as revenue now: no, pending review/payment