feat: Member permissions, optional phone, public users endpoint

- Allow members to create todos, companies, projects
- Auto-assign creator to resources (companyUsers, projectUsers, todoUsers)
- Add public /api/users endpoint for all authenticated users
- Make phone field optional in personal contacts (schema + validation)
- Update todo routes to use checkTodoAccess for updates

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>

src/app.js

@@ -28,6 +28,7 @@ import noteRoutes from './routes/note.routes.js';
 import auditRoutes from './routes/audit.routes.js';
 import eventRoutes from './routes/event.routes.js';
 import messageRoutes from './routes/message.routes.js';
+import userRoutes from './routes/user.routes.js';
 
 const app = express();
 
@@ -122,6 +123,7 @@ app.use('/api/notes', noteRoutes);
 app.use('/api/audit-logs', auditRoutes);
 app.use('/api/events', eventRoutes);
 app.use('/api/messages', messageRoutes);
+app.use('/api/users', userRoutes);
 
 // Basic route
 app.get('/', (req, res) => {