M1 security: close the password backdoor, apply re-review, pin E.164

Acts on an adversarial review of the M1 auth and authorization code.
Five findings fixed; the rest recorded in SECURITY-FINDINGS.md as the
M1 exit criteria rather than left in a tool transcript.

- auth: serve /phone-number/request-password-reset, /phone-number/
  reset-password and /sign-in/phone-number as 404. better-auth's
  phoneNumber() registers all three unconditionally -- they are NOT
  gated on emailAndPassword.enabled:false. Left live they form a
  silent second credential path: request-password-reset stores an OTP
  and sends no SMS (sendPasswordResetOTP was never configured, so the
  owner is never told), reset-password mints a bcrypt credential row,
  and sign-in/phone-number then accepts it forever with no OTP. The
  OTP gate still applies, so this is not remote unauthenticated
  takeover -- it converts one momentary OTP compromise into permanent
  access the victim cannot see or rotate.

- auth: drop bearer(). It accepts the plaintext sessions.token column
  as an Authorization credential, making any single leaked row a
  replayable login. The mobile client it was added for is hypothetical.

- auth: pin E.164 via phoneNumberValidator, and add toE164/isE164 to
  @linkder/shared. phone is UNIQUE and bans are per-account, so
  "+34600111222" and "0034600111222" being separately storable meant
  one handset could hold two accounts and a ban was escapable by
  retyping. 15 tests.

- auth: NEXT_PUBLIC_APP_URL now throws in production instead of
  falling back to localhost, which was silently dropping Secure and
  the __Secure- prefix from the production session cookie.

- pro.upsertProfile: actually apply requiresReReview. It was computed,
  returned to the client and never acted on, so a verified plumber
  could become a verified electrician in another city by ignoring a
  response flag. Now demotes to pending in the same transaction and
  audits it. Trade changes count as material (they did not before) --
  the licence is per-trade. Needed a verified -> pending edge in
  VERIFICATION_GRAPH, which did not exist.

Removed two untracked scratch repro files. The impersonation repro
depended on bearer() for transport and no longer applies as written;
the underlying finding (resolveSession drops impersonatedBy, so admin
actions are audited as the victim) is open and documented.

typecheck, lint, build clean; 127 tests pass.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

packages/storage/test/storage.test.ts

@@ -148,3 +148,31 @@ describe('configuration', () => {
     ).rejects.toThrow(/not allowed/i);
   });
 });
+
+describe('key/URL contract with the API', () => {
+  /**
+   * Regression: credential uploads return an object KEY (they are private and
+   * have no public URL), but the credential schema originally demanded
+   * z.string().url(). The result was that pro onboarding could never be
+   * completed — every document upload failed validation at the last step.
+   *
+   * This asserts the contract in both directions so the two halves cannot drift
+   * apart again.
+   */
+  it('produces a key that is NOT a URL for private kinds', () => {
+    const key = buildKey('credential', OWNER, 'application/pdf');
+    expect(() => new URL(key)).toThrow();
+    expect(isPrivateKind('credential')).toBe(true);
+  });
+
+  it('accepts that key against the credential schema', async () => {
+    const { credentialSchema } = await import('@linkder/shared');
+    const key = buildKey('credential', OWNER, 'application/pdf');
+    expect(credentialSchema.safeParse({ kind: 'insurance', fileKey: key }).success).toBe(true);
+  });
+
+  it('rejects an empty key rather than storing a dangling reference', async () => {
+    const { credentialSchema } = await import('@linkder/shared');
+    expect(credentialSchema.safeParse({ kind: 'insurance', fileKey: '' }).success).toBe(false);
+  });
+});