Add customer accounts, shipment tracking, and purchase reviews.

Shoppers can register, save shipping details, and view order history while cards stay on Stripe. EasyPost tracker updates (including numbers from Pirate Ship) and 1–5 star reviews are limited to buyers. The contact form now only asks for email and a message.

site/accounts/middleware.py

@@ -0,0 +1,23 @@
+from django.shortcuts import redirect
+
+
+class PortalStaffMiddleware:
+    """Keep customer accounts out of the staff portal. Webhooks stay public."""
+
+    PORTAL_PREFIX = "/portal/"
+    WEBHOOK_INFIX = "/webhooks/"
+
+    def __init__(self, get_response):
+        self.get_response = get_response
+
+    def __call__(self, request):
+        path = request.path
+        if path.startswith(self.PORTAL_PREFIX) and self.WEBHOOK_INFIX not in path:
+            user = getattr(request, "user", None)
+            if (
+                user is not None
+                and getattr(user, "is_authenticated", False)
+                and not getattr(user, "is_staff", False)
+            ):
+                return redirect("account:home")
+        return self.get_response(request)