fix(phone): set phone_verified when a phone number is confirmed

[kanakkholwal]

What kind of change does this PR introduce?

Bug fix. Fixes #1906

What is the current behavior?

phone_verified stays false forever after a phone is confirmed, in both
raw_user_meta_data and the phone identity's identity_data. Only
phone_confirmed_at is set.

Not Twilio Verify specific — also happens with the default SMS providers and a
custom send_sms hook.

Cause: Confirm() (email) writes email_verified: true, but ConfirmPhone() only
wrote phone_confirmed_at. All four callers inherited the gap.

What is the new behavior?

Fixed in models.ConfirmPhone instead of at the four call sites, mirroring
Confirm():

• ConfirmPhone sets phone_verified: true on user metadata and on the phone
  identity, plus phone on the identity (signup never populates it).
• ConfirmPhoneChange gets the matching user-metadata update.

Added TestConfirmPhone, extended TestConfirmPhoneChange.
go test ./internal/api/ passes in full.

Additional context

none