[User] Send security email when phone number is cleared

[garyhtou]

Summary

• Send the "Security settings changed" email when a user's phone number is cleared (value → nil). Clearing the phone number removes SMS 2FA capability, so the account owner should be notified.
• When the change is made by an admin via impersonation (Current.session&.impersonated?), the email uses alternate copy: "Phone number was removed by HCB support" (vs. "Phone number was removed" for user-initiated clears) so the user isn't confused by a notification for an action they didn't take.

Notes

• Based on garyhtou/user-phone-number-security-email (issue [User Onboarding] New users get an erroneous "Security settings changed on your HCB account" #13507 fix) — please merge that first.
• Admin-initiated detection uses impersonation since there's no admin UI that directly edits a user's phone number; admins operate via impersonation.

Test plan

• New specs in spec/models/user_spec.rb:
  • sends an email when the user clears their own phone_number (with "Phone number was removed")
  • sends an admin-initiated email when an impersonating admin clears the phone_number (with "Phone number was removed by HCB support")
• Existing security-email specs still pass (11 examples, 0 failures)
• Manually verify email copy in the mailer preview

🤖 Generated with Claude Code

[github-actions]

Suggested change

	"Phone number was removed by HCB support"
	else
	"Phone number was removed"
	end
	"Phone number was removed by HCB support"
	else
	"Phone number was removed"
	end