fix: phone privacy check no longer bypassed for contacts

applyPrivacy() had '!phoneAllowed && !isContact' which meant
contacts always saw the phone number regardless of the user's
privacy settings (e.g. 'Nobody'). Removed the isContact bypass
so privacy rules are enforced for everyone.

internal/app/userprojection/projection.go

@@ -614,7 +614,7 @@ func applyPrivacy(ctx context.Context, privacy PrivacyEvaluator, viewerUserID in
 	if err != nil {
 		return domain.User{}, err
 	}
-	if !phoneAllowed && !isContact {
+	if !phoneAllowed {
 		user.Phone = ""
 	}
 	statusAllowed, err := canSee(domain.PrivacyKeyStatusTimestamp)