Customer accounts, order tracking, and purchase reviews (#8)

## Summary
- Slim the public contact form to email, interest, and message. Name, phone, and address live on the customer profile instead.
- Customers can register, sign in, save shipping details, and view order history. Logged-in checkout creates a Stripe Customer and saves cards on Stripe (`setup_future_usage`); we only store `stripe_customer_id`.
- Shipment tracking: EasyPost tracker lookup + webhook, plus paste-in numbers from Pirate Ship/Shippo. Customers see carrier status on their orders; `dispatch_due` refreshes open shipments.
- Product reviews (1–5) only after a paid/fulfilled purchase of that product.

Fixes #7

## Test plan
- [ ] Contact form submits with only email + message; extra name/phone/address fields are ignored
- [ ] Register, sign in, save profile (name/phone/shipping)
- [ ] Guest checkout still works; after signup, prior orders with that email show in history
- [ ] Logged-in checkout prefills shipping and does not collect card data locally
- [ ] Portal: buy label or paste a Pirate Ship tracking number, confirm status/events; customer order page shows tracking
- [ ] Product page: non-buyers cannot review; buyers can leave one 1–5 star review
- [ ] Non-staff users hitting `/portal/` redirect to `/account/`

Reviewed-on: #8

site/public/notifications.py

@@ -26,8 +26,6 @@ def notify_admins_of_contact_form(lead: Lead) -> bool:
         return False
 
     contact = lead.contact
-    name = contact.full_name or "(no name)"
-    phone = contact.phone or "(none)"
     email = contact.email or "(none)"
     message = (lead.message or "").strip() or "(no message)"
 
@@ -35,27 +33,8 @@ def notify_admins_of_contact_form(lead: Lead) -> bool:
     portal_path = reverse("leads:detail", kwargs={"pk": lead.pk})
     portal_url = f"{site}{portal_path}" if site else portal_path
 
-    postal = contact.postal_address or {}
-    address_bits = [
-        postal.get("line1") or "",
-        postal.get("line2") or "",
-        ", ".join(
-            part
-            for part in [
-                postal.get("city") or "",
-                postal.get("state") or "",
-                postal.get("zip") or "",
-            ]
-            if part
-        ),
-    ]
-    address = "\n".join(bit for bit in address_bits if bit) or "(none)"
-
     ctx = email_brand_context(
-        name=name,
         email=email,
-        phone=phone,
-        address=address,
         message=message,
         portal_url=portal_url,
     )
@@ -63,7 +42,7 @@ def notify_admins_of_contact_form(lead: Lead) -> bool:
     html_content = get_template("emails/contact_email.html").render(ctx)
 
     mail = EmailMultiAlternatives(
-        subject=f"New contact form inquiry from {name}",
+        subject=f"New contact form inquiry from {email}",
         body=text_content,
         from_email=settings.DEFAULT_FROM_EMAIL,
         to=[to_email],