SMS test OTP not honored with Twilio Verify provider

# Bug report - [x] I confirm this is a bug with Supabase, not with my own application. - [x] I confirm I have searched the [Docs](https://docs.supabase.com), GitHub [Discussions](https://github.com/supabase/supabase/discussions), and [Discord](https://discord.supabase.com). ## Describe the bug Supabase hosted Auth appears to ignore configured SMS test OTP entries when Phone Auth is configured with `sms_provider = twilio_verify`. The test OTP entry is visible through the Supabase Management API but `/auth/v1/otp` does not appear to use the test OTP path, and `/auth/v1/verify` rejects the configured test code with `otp_expired`. This reproduces with raw Supabase Auth REST calls, outside our React Native app and outside `supabase-js`. Auth config summary from Management API: ```txt sms_provider: twilio_verify phone_enabled: true phone_autoconfirm: true sms_test_otp_valid_until: 2027-06-30... sms_test_otp contains: <phone digits without leading +>=000000 ``` Example format: ```txt 12125550124=000000 ``` But verifying `000000` fails with: ```json { "error_code": "otp_expired", "msg": "Token has expired or is invalid" } ``` ## To Reproduce 1. In a hosted Supabase project, enable Phone Auth. 2. Configure SMS provider as Twilio Verify. 3. Add a test OTP entry in the dashboard: ```txt 12125550124=000000 ``` The dashboard requires E.164 without the leading `+`. 4. Set `sms_test_otp_valid_until` to a future date. 5. Confirm via Management API that the config exists and is not expired. 6. Request an OTP: ```bash curl -X POST "https://<project-ref>.supabase.co/auth/v1/otp" \ -H "apikey: <publishable-or-anon-key>" \ -H "Authorization: Bearer <publishable-or-anon-key>" \ -H "Content-Type: application/json" \ -d '{"phone":"+12125550124","create_user":false}' ``` 7. Verify using the configured test OTP: ```bash curl -X POST "https://<project-ref>.supabase.co/auth/v1/verify" \ -H "apikey: <publishable-or-anon-key>" \ -H "Au…