feat: gate mobile endpoints behind face enrollment, fix jsonb round-trip

[wailbentafat]

Summary

• Add require_onboarded_mobile_user dependency: every mobile endpoint except /auth/* and /enroll now returns 403 until the user has completed face enrollment (users.face_embedding is set).
• Add is_onboarded to GET /user/auth/me and the avatar upload response so clients can branch on a single field instead of parsing 403 error strings.
• Fix asyncpg/SQLAlchemy jsonb handling: register a jsonb type codec on connect so dict params bind correctly and jsonb columns decode back to dict. This was crashing audit_events writes outright, and silently mismatched typing on notifications/staff_notifications reads.
• Add a dev-env fixed OTP (DEV_OTP_BYPASS_CODE, default 000000) for registration so local/mobile testing doesn't require a real inbox or the NATS email flow.

Test plan

• Login/register verified end-to-end against local Postgres/Redis/NATS/MinIO stack
• Confirmed non-onboarded user gets 403 on /photos, /notifications, /event/join, /event/me
• Confirmed /auth/* and /enroll remain reachable pre-onboarding
• Confirmed GET /user/auth/me returns is_onboarded: false/true correctly
• Confirmed audit event writes/reads round-trip metadata as a dict with no DataError