Add phone-verified user registration

Two-step flow: request a one-time code by email/phone (RegistrationVerification,
mailed via RegistrationCodeMail, rate-limited by the new api-otp limiter keyed
to the identifier), then verify the code and register with RegistrationController.
User gains a phone column/fillable.

app/Providers/AppServiceProvider.php

@@ -56,6 +56,15 @@ class AppServiceProvider extends ServiceProvider
             return Limit::perMinute(10)->by($request->ip());
         });
 
+        // Tighter than api-auth: layered on top of it for the
+        // registration-code request endpoint specifically, keyed by the
+        // identifier being verified (falling back to IP) so one target
+        // can't be bombed with codes even from rotating IPs, and one IP
+        // can't spray codes across many identifiers.
+        RateLimiter::for('api-otp', function (Request $request) {
+            return Limit::perMinutes(10, 3)->by($request->string('identifier')->toString() ?: $request->ip());
+        });
+
         RateLimiter::for('api-webhooks', function (Request $request) {
             return Limit::perMinute(30)->by($request->ip());
         });