Customer accounts, order tracking, and purchase reviews (#8)

## Summary
- Slim the public contact form to email, interest, and message. Name, phone, and address live on the customer profile instead.
- Customers can register, sign in, save shipping details, and view order history. Logged-in checkout creates a Stripe Customer and saves cards on Stripe (`setup_future_usage`); we only store `stripe_customer_id`.
- Shipment tracking: EasyPost tracker lookup + webhook, plus paste-in numbers from Pirate Ship/Shippo. Customers see carrier status on their orders; `dispatch_due` refreshes open shipments.
- Product reviews (1–5) only after a paid/fulfilled purchase of that product.

Fixes #7

## Test plan
- [ ] Contact form submits with only email + message; extra name/phone/address fields are ignored
- [ ] Register, sign in, save profile (name/phone/shipping)
- [ ] Guest checkout still works; after signup, prior orders with that email show in history
- [ ] Logged-in checkout prefills shipping and does not collect card data locally
- [ ] Portal: buy label or paste a Pirate Ship tracking number, confirm status/events; customer order page shows tracking
- [ ] Product page: non-buyers cannot review; buyers can leave one 1–5 star review
- [ ] Non-staff users hitting `/portal/` redirect to `/account/`

Reviewed-on: #8

site/public/views.py

@@ -60,6 +60,7 @@ def robots_txt(request):
             "Allow: /",
             "Disallow: /portal/",
             "Disallow: /accounts/",
+            "Disallow: /account/",
             "Disallow: /admin/",
             "Disallow: /api/",
             f"Sitemap: {site}/sitemap.xml",
@@ -110,48 +111,24 @@ def contact(request):
         form = ContactForm(request.POST)
         if form.is_valid():
             data = form.cleaned_data
-            postal = Contact.make_postal_address(
-                line1=data.get("address_line1") or "",
-                line2=data.get("address_line2") or "",
-                city=data.get("address_city") or "",
-                state=data.get("address_state") or "",
-                zip_code=data.get("address_zip") or "",
-            )
             submitted_email = data["email"].lower()
             contact_obj, _created, match_reason = upsert_contact(
                 email=submitted_email,
-                first_name=data["first_name"],
-                last_name=data.get("last_name") or "",
-                phone=data.get("phone") or "",
-                postal_address=postal
-                if Contact.postal_address_has_content(postal)
-                else None,
                 source=Contact.Source.CONTACT_FORM,
+                merge_phone_address=False,
             )
             ConsentRecord.objects.update_or_create(
                 contact=contact_obj,
                 channel=Channel.EMAIL,
                 defaults={"opted_in": True, "reason": "contact_form"},
             )
-            if (data.get("phone") or "").strip():
-                ConsentRecord.objects.update_or_create(
-                    contact=contact_obj,
-                    channel=Channel.SMS,
-                    defaults={"opted_in": True, "reason": "contact_form"},
-                )
-            if Contact.postal_address_has_content(postal):
-                ConsentRecord.objects.get_or_create(
-                    contact=contact_obj,
-                    channel=Channel.POSTCARD,
-                    defaults={"opted_in": True, "reason": "contact_form"},
-                )
             interest = data.get("interest") or ""
             interest_label = dict(ContactForm.INTEREST_CHOICES).get(interest, interest)
             body = data.get("message") or ""
             if interest_label:
                 body = f"Interest: {interest_label}\n\n{body}".strip()
             if (
-                match_reason in {"phone", "address"}
+                match_reason
                 and (contact_obj.email or "").lower() != submitted_email
             ):
                 body = (