feat: Member permissions, optional phone, public users endpoint

- Allow members to create todos, companies, projects
- Auto-assign creator to resources (companyUsers, projectUsers, todoUsers)
- Add public /api/users endpoint for all authenticated users
- Make phone field optional in personal contacts (schema + validation)
- Update todo routes to use checkTodoAccess for updates

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>

src/routes/user.routes.js

@@ -0,0 +1,34 @@
+import express from 'express';
+import { authenticate } from '../middlewares/auth/authMiddleware.js';
+import { db } from '../config/database.js';
+import { users } from '../db/schema.js';
+
+const router = express.Router();
+
+// All user routes require authentication
+router.use(authenticate);
+
+/**
+ * Get all users (basic info only - for dropdowns, assignment, etc.)
+ * Available to all authenticated users
+ */
+router.get('/', async (req, res, next) => {
+  try {
+    const allUsers = await db
+      .select({
+        id: users.id,
+        username: users.username,
+        firstName: users.firstName,
+        lastName: users.lastName,
+        role: users.role,
+      })
+      .from(users)
+      .orderBy(users.username);
+
+    res.json(allUsers);
+  } catch (error) {
+    next(error);
+  }
+});
+
+export default router;