Customer accounts, order tracking, and purchase reviews (#8)

## Summary
- Slim the public contact form to email, interest, and message. Name, phone, and address live on the customer profile instead.
- Customers can register, sign in, save shipping details, and view order history. Logged-in checkout creates a Stripe Customer and saves cards on Stripe (`setup_future_usage`); we only store `stripe_customer_id`.
- Shipment tracking: EasyPost tracker lookup + webhook, plus paste-in numbers from Pirate Ship/Shippo. Customers see carrier status on their orders; `dispatch_due` refreshes open shipments.
- Product reviews (1–5) only after a paid/fulfilled purchase of that product.

Fixes #7

## Test plan
- [ ] Contact form submits with only email + message; extra name/phone/address fields are ignored
- [ ] Register, sign in, save profile (name/phone/shipping)
- [ ] Guest checkout still works; after signup, prior orders with that email show in history
- [ ] Logged-in checkout prefills shipping and does not collect card data locally
- [ ] Portal: buy label or paste a Pirate Ship tracking number, confirm status/events; customer order page shows tracking
- [ ] Product page: non-buyers cannot review; buyers can leave one 1–5 star review
- [ ] Non-staff users hitting `/portal/` redirect to `/account/`

Reviewed-on: #8

site/accounts/views.py

@@ -0,0 +1,119 @@
+from django.contrib import messages
+from django.contrib.auth import login, logout
+from django.contrib.auth.decorators import login_required
+from django.contrib.auth.views import LoginView
+from django.shortcuts import redirect, render
+from django.urls import reverse
+from django.views.decorators.http import require_http_methods
+
+from accounts.forms import (
+    CustomerAuthenticationForm,
+    CustomerProfileForm,
+    CustomerRegisterForm,
+)
+from accounts.services import claim_orders_for_user, get_customer_profile
+
+
+class PortalLoginView(LoginView):
+    template_name = "accounts/login.html"
+
+    def get_success_url(self):
+        url = self.get_redirect_url()
+        if url:
+            return url
+        if self.request.user.is_staff:
+            return reverse("dashboard:home")
+        return reverse("account:home")
+
+
+class CustomerLoginView(LoginView):
+    template_name = "accounts/customer_login.html"
+    authentication_form = CustomerAuthenticationForm
+    redirect_authenticated_user = True
+
+    def get_success_url(self):
+        url = self.get_redirect_url()
+        if url:
+            return url
+        if self.request.user.is_staff:
+            return reverse("dashboard:home")
+        return reverse("account:home")
+
+
+@require_http_methods(["GET", "POST"])
+def customer_register(request):
+    if request.user.is_authenticated:
+        return redirect("account:home")
+    if request.method == "POST":
+        form = CustomerRegisterForm(request.POST)
+        if form.is_valid():
+            user = form.save()
+            get_customer_profile(user)
+            claimed = claim_orders_for_user(user)
+            login(request, user)
+            if claimed:
+                messages.success(
+                    request,
+                    f"Account created. {claimed} existing order(s) are now in your history.",
+                )
+            else:
+                messages.success(request, "Account created. Welcome.")
+            return redirect("account:home")
+    else:
+        initial = {}
+        email = (request.GET.get("email") or "").strip()
+        if email:
+            initial["email"] = email
+        form = CustomerRegisterForm(initial=initial)
+    return render(request, "accounts/register.html", {"form": form})
+
+
+@require_http_methods(["GET", "POST"])
+def customer_logout(request):
+    logout(request)
+    messages.success(request, "Signed out.")
+    return redirect("public:home")
+
+
+@login_required(login_url="account:login")
+def customer_home(request):
+    from django.apps import apps
+
+    if apps.is_installed("shop"):
+        return redirect("account:orders")
+    return redirect("account:profile")
+
+
+@login_required(login_url="account:login")
+@require_http_methods(["GET", "POST"])
+def customer_profile(request):
+    profile = get_customer_profile(request.user)
+    addr = profile.shipping_address or {}
+    initial = {
+        "first_name": request.user.first_name,
+        "last_name": request.user.last_name,
+        "phone": profile.phone,
+        "address_line1": addr.get("line1") or "",
+        "address_line2": addr.get("line2") or "",
+        "address_city": addr.get("city") or "",
+        "address_state": addr.get("state") or "",
+        "address_zip": addr.get("zip") or "",
+    }
+    if request.method == "POST":
+        form = CustomerProfileForm(request.POST)
+        if form.is_valid():
+            request.user.first_name = form.cleaned_data.get("first_name") or ""
+            request.user.last_name = form.cleaned_data.get("last_name") or ""
+            request.user.save(update_fields=["first_name", "last_name"])
+            profile.phone = form.cleaned_data.get("phone") or ""
+            profile.shipping_address = form.shipping_address()
+            profile.save(update_fields=["phone", "shipping_address", "updated_at"])
+            messages.success(request, "Profile saved.")
+            return redirect("account:profile")
+    else:
+        form = CustomerProfileForm(initial=initial)
+    return render(
+        request,
+        "accounts/profile.html",
+        {"form": form, "profile": profile},
+    )