Customer accounts, order tracking, and purchase reviews (#8)

## Summary
- Slim the public contact form to email, interest, and message. Name, phone, and address live on the customer profile instead.
- Customers can register, sign in, save shipping details, and view order history. Logged-in checkout creates a Stripe Customer and saves cards on Stripe (`setup_future_usage`); we only store `stripe_customer_id`.
- Shipment tracking: EasyPost tracker lookup + webhook, plus paste-in numbers from Pirate Ship/Shippo. Customers see carrier status on their orders; `dispatch_due` refreshes open shipments.
- Product reviews (1–5) only after a paid/fulfilled purchase of that product.

Fixes #7

## Test plan
- [ ] Contact form submits with only email + message; extra name/phone/address fields are ignored
- [ ] Register, sign in, save profile (name/phone/shipping)
- [ ] Guest checkout still works; after signup, prior orders with that email show in history
- [ ] Logged-in checkout prefills shipping and does not collect card data locally
- [ ] Portal: buy label or paste a Pirate Ship tracking number, confirm status/events; customer order page shows tracking
- [ ] Product page: non-buyers cannot review; buyers can leave one 1–5 star review
- [ ] Non-staff users hitting `/portal/` redirect to `/account/`

Reviewed-on: #8

site/contacts/tests_merge.py

@@ -130,19 +130,12 @@ class ContactFormMergeTests(TestCase):
             ),
         )
 
-    def test_contact_form_merges_on_phone(self):
+    def test_contact_form_merges_on_email(self):
         url = reverse("public:contact")
         response = self.client.post(
             url,
             {
-                "first_name": "Alex",
-                "last_name": "Lee",
-                "email": "alt@example.com",
-                "phone": "(630) 111-2222",
-                "address_line1": "55 River Rd",
-                "address_city": "Aurora",
-                "address_state": "IL",
-                "address_zip": "60505",
+                "email": "primary@example.com",
                 "interest": "general",
                 "message": "Looking to buy",
             },
@@ -151,15 +144,35 @@ class ContactFormMergeTests(TestCase):
         self.assertEqual(Contact.objects.count(), 1)
         lead = Lead.objects.get()
         self.assertEqual(lead.contact_id, self.existing.pk)
-        self.assertIn("alt@example.com", lead.message)
-        self.assertIn("merged by phone", lead.message)
+        self.assertIn("Looking to buy", lead.message)
+
+    def test_contact_form_skips_name_phone_address(self):
+        url = reverse("public:contact")
+        response = self.client.post(
+            url,
+            {
+                "email": "newbuyer@example.com",
+                "interest": "custom",
+                "message": "Can you print a fox?",
+                "first_name": "Ignored",
+                "phone": "6301112222",
+                "address_line1": "55 River Rd",
+            },
+        )
+        self.assertEqual(response.status_code, 302)
+        from contacts.models import Contact as ContactModel
+
+        created = ContactModel.objects.get(email="newbuyer@example.com")
+        self.assertEqual(created.first_name, "")
+        self.assertEqual(created.phone, "")
+        self.assertEqual(created.postal_address, {})
 
 
 class PortalCreateMatchPromptTests(TestCase):
     def setUp(self):
         User = get_user_model()
         self.user = User.objects.create_user(
-            username="adder", password="test-pass-123"
+            username="adder", password="test-pass-123", is_staff=True
         )
         self.client = Client()
         self.client.login(username="adder", password="test-pass-123")
@@ -225,7 +238,7 @@ class ContactListTests(TestCase):
     def setUp(self):
         User = get_user_model()
         self.user = User.objects.create_user(
-            username="lister", password="test-pass-123"
+            username="lister", password="test-pass-123", is_staff=True
         )
         self.client = Client()
         self.client.login(username="lister", password="test-pass-123")