Add shopper password reset and extend demo seed for accounts, reviews, and tracking.

Buyers can recover locked accounts, and seed_demo now walks the shopper path without live Stripe or EasyPost calls.

site/accounts/tests.py

@@ -1,6 +1,10 @@
 from django.contrib.auth import get_user_model
+from django.contrib.auth.tokens import default_token_generator
+from django.core import mail
 from django.test import Client, TestCase
 from django.urls import reverse
+from django.utils.encoding import force_bytes
+from django.utils.http import urlsafe_base64_encode
 
 from accounts.models import CustomerProfile
 from shop.models import Order
@@ -86,3 +90,39 @@ class CustomerAccountTests(TestCase):
         response = client.get(reverse("dashboard:home"))
         self.assertEqual(response.status_code, 302)
         self.assertEqual(response["Location"], reverse("account:home"))
+
+    def test_password_reset_sends_mail_and_sets_new_password(self):
+        user = User.objects.create_user(
+            username="buyer@example.com",
+            email="buyer@example.com",
+            password="s3cure-pass-123",
+        )
+        client = Client()
+        login_page = client.get(reverse("account:login"))
+        self.assertContains(login_page, reverse("account:password_reset"))
+        posted = client.post(
+            reverse("account:password_reset"),
+            {"email": "buyer@example.com"},
+        )
+        self.assertEqual(posted.status_code, 302)
+        self.assertEqual(len(mail.outbox), 1)
+        self.assertIn("password-reset", mail.outbox[0].body)
+        uid = urlsafe_base64_encode(force_bytes(user.pk))
+        token = default_token_generator.make_token(user)
+        confirm_url = reverse(
+            "account:password_reset_confirm",
+            kwargs={"uidb64": uid, "token": token},
+        )
+        bounced = client.get(confirm_url)
+        self.assertEqual(bounced.status_code, 302)
+        set_url = bounced["Location"]
+        saved = client.post(
+            set_url,
+            {
+                "new_password1": "n3wer-pass-456",
+                "new_password2": "n3wer-pass-456",
+            },
+        )
+        self.assertEqual(saved.status_code, 302)
+        user.refresh_from_db()
+        self.assertTrue(user.check_password("n3wer-pass-456"))