feat: Member permissions, optional phone, public users endpoint

- Allow members to create todos, companies, projects
- Auto-assign creator to resources (companyUsers, projectUsers, todoUsers)
- Add public /api/users endpoint for all authenticated users
- Make phone field optional in personal contacts (schema + validation)
- Update todo routes to use checkTodoAccess for updates

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>

src/routes/company.routes.js

@@ -44,10 +44,9 @@ router.get(
   companyController.getCompanyById
 );
 
-// Create new company (admin only)
+// Create new company (any authenticated user)
 router.post(
   '/',
-  requireAdmin,
   validateBody(createCompanySchema),
   companyController.createCompany
 );