feat(cli): OS_AUTH_PHONE_NUMBER_ENABLED switch for the phoneNumber plugin

plugins.phoneNumber existed in AuthPluginConfig (#2766) but `objectstack
serve` never set it - there was no way to turn phone sign-in/OTP on from
the CLI. Follows the OS_{DOMAIN}_{FEATURE}_ENABLED convention; default off.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_013LXUXU66dBaP3SSG4ZVtuH

Author: claude

packages/cli/src/commands/serve.ts

@@ -1259,6 +1259,12 @@ export default class Serve extends Command {
                 // operator override (env wins in buildPluginList()).
                 passwordRejectBreached:
                   String(process.env.OS_AUTH_PASSWORD_REJECT_BREACHED ?? 'false').toLowerCase() === 'true',
+                // #2766/#2780 — phone-number sign-in (phone+password always;
+                // OTP sign-in/reset once the sms capability has a deliverable
+                // provider). Opt-in: without this env the config flag had no
+                // `objectstack serve` switch at all.
+                phoneNumber:
+                  String(process.env.OS_AUTH_PHONE_NUMBER_ENABLED ?? 'false').toLowerCase() === 'true',
               },
               advanced: process.env.OS_COOKIE_DOMAIN
                 ? ({