Add optional phone number to users

[costajohnt]

Resolves #5687

Description

Banks sometimes need to call an individual partner user, not only the partner's formal contacts. This adds a nullable phone_number string to users (same shape as the phone_number added to partners in 8317eae, no validation, same as vendors and donation sites) and exposes it wherever a user is invited or edited:

• Bank managing partner users (/partners/:id/users): a Phone Number field on the invite form, saved through UserInviteService, shown under the email in the users table.
• Partner's own user management (Partners::UsersController): invite form, the user's edit form, and a Phone column on the list.
• Admin user and organization forms (they share _user_form_fields), including both create paths.
• Account settings (/users/edit), through the Devise account_update sanitizer.

UserInviteService only sets the phone on newly invited users. When an existing user is re-invited to another resource their record is not touched, which is what already happens with name.

One thing I left alone: blank values from the edit forms are stored as "" while the invite path stores nil (.presence). Neither is rendered differently and it matches how Partner#phone_number behaves; happy to add a normalizes if you'd rather have nil everywhere.

Type of change

• New feature (non-breaking change which adds functionality)

How Has This Been Tested?

• spec/requests/partner_users_requests_spec.rb: invite persists the phone; the users page renders it.
• spec/requests/partners/user_requests_spec.rb: partner-side invite and self-edit persist it.
• spec/requests/admin/users_requests_spec.rb and spec/requests/admin/organizations_requests_spec.rb: admin create and update persist it.
• spec/requests/users/registrations_requests_spec.rb (new): account settings update persists it.
• Each of the five permits and the invite assignment has an assertion that fails when it is removed (Rails drops the unpermitted param silently, so the reload assertions are the check). bundle exec rubocop and bundle exec erb_lint are clean on the changed files.

[dorner]

One comment, otherwise looks good. Needs manual testing / approval.

[dorner]

Probably should read something like "Contact Information"? @ruestitch @janeewheatley

[costajohnt]

Renamed the header to "Contact Information" in 64510ce.

[Sinkleberg]

Tested the phone forms locally with synthetic accounts. New invitations and admin-created users saved the number; blanks were optional, editing/clearing worked, and existing users kept their original contact details. The 90 focused tests and eight supplemental checks passed, and I verified nine Chromium form flows. CSS/fonts were blocked, so I haven't checked the visual layout or run the full suite.

I also have a finding I'd like to share privately before this is merged. What's the best maintainer contact?

[dorner]

There are conflicts now. Still waiting to hear from @janeewheatley or @ruestitch for any feedback.

If you mean a security concern, you can DM me on the Human Resources Slack (instructions in the contribution guidelines).

[costajohnt]

Merged main in and resolved the conflict (just the schema.rb version line). Nothing else changed, so I'll leave it for @janeewheatley / @ruestitch to weigh in.