2. User Authentication & Account Management

## Parent PRD

#1

## What to build

Complete end-to-end user authentication system with registration, login, profile management, and phone OTP verification. Users should be able to sign up with email/phone, login with JWT tokens, update their profile, and verify their phone via OTP.

Implements database schema for users and payment methods, JWT middleware for all protected endpoints, password hashing with bcrypt, and phone OTP verification via mock SMS provider.

## Acceptance criteria

- [ ] `POST /auth/register` accepts email, phone, password → creates user, returns JWT
- [ ] `POST /auth/login` accepts email + password → validates credentials, returns JWT token
- [ ] `GET /auth/me` returns authenticated user profile (JWT required)
- [ ] `PUT /auth/profile` updates user name, phone, email (JWT required)
- [ ] `POST /auth/send-otp` sends OTP to phone (mock SMS provider)
- [ ] `POST /auth/verify-otp` verifies OTP matches sent code
- [ ] Passwords hashed with bcrypt, never stored in plain text
- [ ] JWT tokens include expiry (15 days)
- [ ] Invalid login credentials return 401 Unauthorized
- [ ] Database schema: `users` table with email, phone, hashed_password, role, created_at

## Blocked by

- Blocked by #2 (Project Setup)

## User stories addressed

- User story 23: Update profile
- User story 24: Receive email/SMS notifications (base)