Customer accounts, order tracking, and purchase reviews (#8)

## Summary
- Slim the public contact form to email, interest, and message. Name, phone, and address live on the customer profile instead.
- Customers can register, sign in, save shipping details, and view order history. Logged-in checkout creates a Stripe Customer and saves cards on Stripe (`setup_future_usage`); we only store `stripe_customer_id`.
- Shipment tracking: EasyPost tracker lookup + webhook, plus paste-in numbers from Pirate Ship/Shippo. Customers see carrier status on their orders; `dispatch_due` refreshes open shipments.
- Product reviews (1–5) only after a paid/fulfilled purchase of that product.

Fixes #7

## Test plan
- [ ] Contact form submits with only email + message; extra name/phone/address fields are ignored
- [ ] Register, sign in, save profile (name/phone/shipping)
- [ ] Guest checkout still works; after signup, prior orders with that email show in history
- [ ] Logged-in checkout prefills shipping and does not collect card data locally
- [ ] Portal: buy label or paste a Pirate Ship tracking number, confirm status/events; customer order page shows tracking
- [ ] Product page: non-buyers cannot review; buyers can leave one 1–5 star review
- [ ] Non-staff users hitting `/portal/` redirect to `/account/`

Reviewed-on: #8

site/accounts/customer_urls.py

@@ -0,0 +1,62 @@
+from django.apps import apps
+from django.contrib.auth import views as auth_views
+from django.urls import path, reverse_lazy
+
+from accounts import views
+from accounts.forms import CustomerPasswordResetForm, CustomerSetPasswordForm
+
+app_name = "account"
+
+urlpatterns = [
+    path("", views.customer_home, name="home"),
+    path("login/", views.CustomerLoginView.as_view(), name="login"),
+    path("logout/", views.customer_logout, name="logout"),
+    path("register/", views.customer_register, name="register"),
+    path("profile/", views.customer_profile, name="profile"),
+    path(
+        "password-reset/",
+        auth_views.PasswordResetView.as_view(
+            template_name="accounts/password_reset_form.html",
+            email_template_name="accounts/password_reset_email.txt",
+            subject_template_name="accounts/password_reset_subject.txt",
+            form_class=CustomerPasswordResetForm,
+            success_url=reverse_lazy("account:password_reset_done"),
+        ),
+        name="password_reset",
+    ),
+    path(
+        "password-reset/done/",
+        auth_views.PasswordResetDoneView.as_view(
+            template_name="accounts/password_reset_done.html",
+        ),
+        name="password_reset_done",
+    ),
+    path(
+        "password-reset/<uidb64>/<token>/",
+        auth_views.PasswordResetConfirmView.as_view(
+            template_name="accounts/password_reset_confirm.html",
+            form_class=CustomerSetPasswordForm,
+            success_url=reverse_lazy("account:password_reset_complete"),
+        ),
+        name="password_reset_confirm",
+    ),
+    path(
+        "password-reset/complete/",
+        auth_views.PasswordResetCompleteView.as_view(
+            template_name="accounts/password_reset_complete.html",
+        ),
+        name="password_reset_complete",
+    ),
+]
+
+if apps.is_installed("shop"):
+    from shop import views as shop_views
+
+    urlpatterns += [
+        path("orders/", shop_views.account_order_list, name="orders"),
+        path(
+            "orders/<uuid:pk>/",
+            shop_views.account_order_detail,
+            name="order_detail",
+        ),
+    ]