feat: Member permissions, optional phone, public users endpoint

- Allow members to create todos, companies, projects
- Auto-assign creator to resources (companyUsers, projectUsers, todoUsers)
- Add public /api/users endpoint for all authenticated users
- Make phone field optional in personal contacts (schema + validation)
- Update todo routes to use checkTodoAccess for updates

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>

src/db/schema.js

@@ -87,7 +87,7 @@ export const personalContacts = pgTable('personal_contacts', {
   companyId: uuid('company_id').references(() => companies.id, { onDelete: 'set null' }), // voliteľná väzba na firmu
   firstName: text('first_name').notNull(),
   lastName: text('last_name'),
-  phone: text('phone').notNull(),
+  phone: text('phone'), // optional
   email: text('email').notNull(),
   secondaryEmail: text('secondary_email'),
   description: text('description'), // popis kontaktu