Mint campaign UTM links through the piha.li shortener (#10)

## Summary
Closes #9.

- Campaign composer auto-inserts a tracked homepage link (`utm_source=monica`, `utm_medium` = channel, `utm_campaign` = slug of the name) for email, SMS, and postcard QR — no manual UTM paste.
- When `SHORTENER_BASE_URL` + `SHORTENER_API_TOKEN` are set, the app mints that long HTTPS URL via `POST /api/links/` on the shortener **API host** and puts the returned `piha.li` / `beta.piha.li` short URL in SMS, email hrefs, and QR codes. Empty env (local) falls back to the long UTM URL.
- Live composer resolves shorts through a portal JSON endpoint (login + CSRF). Browser never calls the shortener.

## Secrets (control node, not git)

**monica_site** (`~/Documents/secrets/monica_site/`):
```
# prod
SHORTENER_BASE_URL=https://shortener.aimloperations.com
SHORTENER_API_TOKEN=monica:<secret>

# beta
SHORTENER_BASE_URL=https://shortener-beta.aimloperations.com
SHORTENER_API_TOKEN=monica:<beta-secret>
```

**url_shortening_service** (same secret, named token):
```
SHORTENER_API_TOKENS=monica:<secret>
SHORT_ALLOWED_HOSTS=mkdrealtor.com,aimloperations.com
```
Prod public short host: `piha.li`. Beta: `beta.piha.li`. Generate with `python -c "import secrets; print(secrets.token_urlsafe(32))"`.

Template port: westfarn/web_django_template#3

## Test plan
- [ ] `cd site && uv run python manage.py test messaging.tests.CampaignUtmLinkTests`
- [ ] Composer: type a campaign name — email gets an HTML link, SMS gets a URL, postcard shows a QR
- [ ] With shortener env set: SMS/QR show `piha.li` (or `beta.piha.li`); without it, long UTM URL still works
- [ ] Copy/download QR into postcard designer
- [ ] Secret files have `SHORTENER_*` on both caller and operator sides before beta/prod deploy

Reviewed-on: #10

site/messaging/shortener.py

@@ -0,0 +1,87 @@
+"""Server-to-server client for url_shortening_service (piha.li).
+
+Call the API host (`SHORTENER_BASE_URL`), never the public short domain.
+Auth: Authorization: Bearer <SHORTENER_API_TOKEN> (name:secret).
+"""
+
+from __future__ import annotations
+
+import logging
+
+import requests
+from django.conf import settings
+
+logger = logging.getLogger(__name__)
+
+
+def is_configured() -> bool:
+    base = (getattr(settings, "SHORTENER_BASE_URL", None) or "").strip()
+    token = (getattr(settings, "SHORTENER_API_TOKEN", None) or "").strip()
+    return bool(base and token)
+
+
+def mint_short_url(
+    target_url: str,
+    *,
+    title: str = "",
+    external_ref: str = "",
+) -> str | None:
+    """POST /api/links/. Return short_url, or None if unconfigured / failed.
+
+    Does not raise. Compose must still work when the shortener is down or unset.
+    """
+    if not is_configured():
+        return None
+    target = (target_url or "").strip()
+    if not target.lower().startswith("https://"):
+        logger.info("shortener skip: target is not https")
+        return None
+
+    base = str(settings.SHORTENER_BASE_URL).rstrip("/")
+    token = str(settings.SHORTENER_API_TOKEN).strip()
+    timeout = int(getattr(settings, "SHORTENER_TIMEOUT_SECONDS", 10) or 10)
+    try:
+        response = requests.post(
+            f"{base}/api/links/",
+            headers={
+                "Authorization": f"Bearer {token}",
+                "Content-Type": "application/json",
+            },
+            json={
+                "target_url": target,
+                "title": (title or "")[:200],
+                "external_ref": (external_ref or "")[:64],
+            },
+            timeout=timeout,
+        )
+    except requests.RequestException:
+        logger.exception("shortener request failed")
+        return None
+
+    if response.status_code not in (200, 201):
+        logger.warning(
+            "shortener mint failed status=%s",
+            response.status_code,
+        )
+        return None
+    try:
+        data = response.json()
+    except ValueError:
+        logger.warning("shortener mint returned non-json")
+        return None
+    if not isinstance(data, dict):
+        return None
+    short = (data.get("short_url") or "").strip()
+    return short or None
+
+
+def resolve_display_url(
+    target_url: str,
+    *,
+    title: str = "",
+    external_ref: str = "",
+) -> str:
+    """Short URL when mint succeeds, otherwise the original target."""
+    return mint_short_url(
+        target_url, title=title, external_ref=external_ref
+    ) or target_url