fix(auth): validate verify sms profile strings

[aiirvizionz]

Summary

• reject non-string username and displayName values in verify-sms before DB/session work
• keep signup profile fields constrained to text payloads
• add regression coverage for numeric usernames in the session completion flow

Test

• node node_modules\vitest\vitest.mjs run --config %TEMP%\qryptchat-vitest-minimal.config.mjs "src/app/api/auth/verify-sms/route.test.js"
• git diff --check

uGig billing

• Expected invoice: 0.50 USD if accepted/merged
• Counted as revenue now: no, pending review/payment