Sends a 6-digit OTP to the provided phone number to initiate a password reset.
Returns the same response whether or not an account exists — prevents phone enumeration.
Follow up with POST /auth-reset-password once the user has the OTP.
OTP sent (or silently skipped if no account found)