Mint campaign UTM links through the piha.li shortener (#10)

## Summary
Closes #9.

- Campaign composer auto-inserts a tracked homepage link (`utm_source=monica`, `utm_medium` = channel, `utm_campaign` = slug of the name) for email, SMS, and postcard QR — no manual UTM paste.
- When `SHORTENER_BASE_URL` + `SHORTENER_API_TOKEN` are set, the app mints that long HTTPS URL via `POST /api/links/` on the shortener **API host** and puts the returned `piha.li` / `beta.piha.li` short URL in SMS, email hrefs, and QR codes. Empty env (local) falls back to the long UTM URL.
- Live composer resolves shorts through a portal JSON endpoint (login + CSRF). Browser never calls the shortener.

## Secrets (control node, not git)

**monica_site** (`~/Documents/secrets/monica_site/`):
```
# prod
SHORTENER_BASE_URL=https://shortener.aimloperations.com
SHORTENER_API_TOKEN=monica:<secret>

# beta
SHORTENER_BASE_URL=https://shortener-beta.aimloperations.com
SHORTENER_API_TOKEN=monica:<beta-secret>
```

**url_shortening_service** (same secret, named token):
```
SHORTENER_API_TOKENS=monica:<secret>
SHORT_ALLOWED_HOSTS=mkdrealtor.com,aimloperations.com
```
Prod public short host: `piha.li`. Beta: `beta.piha.li`. Generate with `python -c "import secrets; print(secrets.token_urlsafe(32))"`.

Template port: westfarn/web_django_template#3

## Test plan
- [ ] `cd site && uv run python manage.py test messaging.tests.CampaignUtmLinkTests`
- [ ] Composer: type a campaign name — email gets an HTML link, SMS gets a URL, postcard shows a QR
- [ ] With shortener env set: SMS/QR show `piha.li` (or `beta.piha.li`); without it, long UTM URL still works
- [ ] Copy/download QR into postcard designer
- [ ] Secret files have `SHORTENER_*` on both caller and operator sides before beta/prod deploy

Reviewed-on: #10

.env.example

@@ -79,6 +79,14 @@ SOCIAL_TOKEN_ENCRYPTION_KEY=
 OLLAMA_BASE_URL=http://10.0.0.128:11434
 OLLAMA_MODEL=llama3.2
 
+# URL shortener (piha.li). Empty locally = long UTM URLs in campaigns.
+# Call the API host, never https://piha.li (that host only 302s).
+SHORTENER_BASE_URL=
+SHORTENER_API_TOKEN=
+# Local shortener compose:
+# SHORTENER_BASE_URL=http://127.0.0.1:8005
+# SHORTENER_API_TOKEN=monica:dev-only-token
+
 # Nominatim (LAN) — address autocomplete via Django /api/address-suggest/
 # Nominatim has no built-in API keys; optional NOMINATIM_API_KEY only if you
 # put a gateway in front that checks X-API-Key.