Customer accounts, order tracking, and purchase reviews (#8)

## Summary
- Slim the public contact form to email, interest, and message. Name, phone, and address live on the customer profile instead.
- Customers can register, sign in, save shipping details, and view order history. Logged-in checkout creates a Stripe Customer and saves cards on Stripe (`setup_future_usage`); we only store `stripe_customer_id`.
- Shipment tracking: EasyPost tracker lookup + webhook, plus paste-in numbers from Pirate Ship/Shippo. Customers see carrier status on their orders; `dispatch_due` refreshes open shipments.
- Product reviews (1–5) only after a paid/fulfilled purchase of that product.

Fixes #7

## Test plan
- [ ] Contact form submits with only email + message; extra name/phone/address fields are ignored
- [ ] Register, sign in, save profile (name/phone/shipping)
- [ ] Guest checkout still works; after signup, prior orders with that email show in history
- [ ] Logged-in checkout prefills shipping and does not collect card data locally
- [ ] Portal: buy label or paste a Pirate Ship tracking number, confirm status/events; customer order page shows tracking
- [ ] Product page: non-buyers cannot review; buyers can leave one 1–5 star review
- [ ] Non-staff users hitting `/portal/` redirect to `/account/`

Reviewed-on: #8

site/email_sms/tests.py

@@ -123,7 +123,7 @@ class PortalConsentToggleTests(TestCase):
     def setUp(self):
         User = get_user_model()
         self.user = User.objects.create_user(
-            username="monica", password="test-pass-123"
+            username="monica", password="test-pass-123", is_staff=True
         )
         self.client = Client()
         self.client.login(username="monica", password="test-pass-123")
@@ -190,7 +190,7 @@ class CampaignDraftSaveTests(TestCase):
     def setUp(self):
         User = get_user_model()
         self.user = User.objects.create_user(
-            username="composer", password="test-pass-123"
+            username="composer", password="test-pass-123", is_staff=True
         )
         self.client = Client()
         self.client.login(username="composer", password="test-pass-123")
@@ -260,7 +260,7 @@ class CampaignSendTests(TestCase):
     def setUp(self):
         User = get_user_model()
         self.user = User.objects.create_user(
-            username="sender", password="test-pass-123", email="sender@example.com"
+            username="sender", password="test-pass-123", email="sender@example.com", is_staff=True
         )
         self.client = Client()
         self.client.login(username="sender", password="test-pass-123")
@@ -467,7 +467,7 @@ class Smtp2goEmailWebhookTests(TestCase):
 
     def test_status_json_includes_opens(self):
         User = get_user_model()
-        user = User.objects.create_user(username="viewer", password="test-pass-123")
+        user = User.objects.create_user(username="viewer", password="test-pass-123", is_staff=True)
         self.client.login(username="viewer", password="test-pass-123")
         ProviderEvent.objects.create(
             message=self.message,
@@ -946,7 +946,7 @@ class StoredFileUploadTests(TestCase):
     def setUp(self):
         User = get_user_model()
         self.user = User.objects.create_user(
-            username="uploader", password="test-pass-123"
+            username="uploader", password="test-pass-123", is_staff=True
         )
         self.client = Client()
         self.client.login(username="uploader", password="test-pass-123")
@@ -1030,7 +1030,7 @@ class CampaignRecipientTableTests(TestCase):
 
         User = get_user_model()
         self.user = User.objects.create_user(
-            username="recip", password="test-pass-123"
+            username="recip", password="test-pass-123", is_staff=True
         )
         self.client = Client()
         self.client.login(username="recip", password="test-pass-123")
@@ -1169,7 +1169,7 @@ class CampaignUtmLinkTests(TestCase):
     def setUp(self):
         User = get_user_model()
         self.user = User.objects.create_user(
-            username="utm-composer", password="test-pass-123"
+            username="utm-composer", password="test-pass-123", is_staff=True
         )
         self.client = Client()
         self.client.login(username="utm-composer", password="test-pass-123")