Customer accounts, order tracking, and purchase reviews (#8)

## Summary
- Slim the public contact form to email, interest, and message. Name, phone, and address live on the customer profile instead.
- Customers can register, sign in, save shipping details, and view order history. Logged-in checkout creates a Stripe Customer and saves cards on Stripe (`setup_future_usage`); we only store `stripe_customer_id`.
- Shipment tracking: EasyPost tracker lookup + webhook, plus paste-in numbers from Pirate Ship/Shippo. Customers see carrier status on their orders; `dispatch_due` refreshes open shipments.
- Product reviews (1–5) only after a paid/fulfilled purchase of that product.

Fixes #7

## Test plan
- [ ] Contact form submits with only email + message; extra name/phone/address fields are ignored
- [ ] Register, sign in, save profile (name/phone/shipping)
- [ ] Guest checkout still works; after signup, prior orders with that email show in history
- [ ] Logged-in checkout prefills shipping and does not collect card data locally
- [ ] Portal: buy label or paste a Pirate Ship tracking number, confirm status/events; customer order page shows tracking
- [ ] Product page: non-buyers cannot review; buyers can leave one 1–5 star review
- [ ] Non-staff users hitting `/portal/` redirect to `/account/`

Reviewed-on: #8

site/shipping/tests.py

@@ -1,4 +1,5 @@
 from decimal import Decimal
+import json
 
 from django.contrib.auth import get_user_model
 from django.test import Client, TestCase
@@ -49,11 +50,63 @@ class ShippingServiceTests(TestCase):
         buy_label(shipment)
         self.assertNotIn(self.order.number, pirate_ship_csv())
 
+    def test_stub_buy_sets_pre_transit_tracking(self):
+        shipment = create_shipment_for_order(self.order)
+        quote_rates(shipment)
+        buy_label(shipment)
+        shipment.refresh_from_db()
+        self.assertTrue(shipment.tracking_number)
+        self.assertEqual(shipment.tracking_status, Shipment.TrackingStatus.PRE_TRANSIT)
+        self.assertTrue(shipment.tracking_url)
+
+    def test_attach_tracking_from_pirate_ship(self):
+        from shipping.services import attach_tracking
+
+        shipment = create_shipment_for_order(self.order)
+        attach_tracking(shipment, tracking_number="9400111899223197428490", carrier="USPS")
+        shipment.refresh_from_db()
+        self.assertEqual(shipment.status, Shipment.Status.LABELED)
+        self.assertEqual(shipment.tracking_status, Shipment.TrackingStatus.PRE_TRANSIT)
+        self.assertIn("usps.com", shipment.tracking_url.lower())
+
+    def test_easypost_webhook_updates_status(self):
+        shipment = create_shipment_for_order(self.order)
+        shipment.tracking_number = "EZ1000000001"
+        shipment.status = Shipment.Status.LABELED
+        shipment.save()
+        payload = {
+            "description": "tracker.updated",
+            "result": {
+                "id": "trk_test",
+                "tracking_code": "EZ1000000001",
+                "status": "in_transit",
+                "public_url": "https://track.easypost.com/djE0",
+                "tracking_details": [
+                    {
+                        "status": "in_transit",
+                        "message": "Departed facility",
+                        "datetime": "2026-09-07T12:00:00Z",
+                        "tracking_location": {"city": "Chicago", "state": "IL"},
+                    }
+                ],
+            },
+        }
+        response = Client().post(
+            reverse("shipping:easypost_webhook"),
+            data=json.dumps(payload),
+            content_type="application/json",
+        )
+        self.assertEqual(response.status_code, 200)
+        shipment.refresh_from_db()
+        self.assertEqual(shipment.tracking_status, Shipment.TrackingStatus.IN_TRANSIT)
+        self.assertEqual(shipment.tracker_id, "trk_test")
+        self.assertEqual(shipment.tracking_events[0]["location"], "Chicago IL")
+
 
 class ShippingPortalTests(TestCase):
     def setUp(self):
         User = get_user_model()
-        self.user = User.objects.create_user("shipper", password="test-pass-123")
+        self.user = User.objects.create_user("shipper", password="test-pass-123", is_staff=True)
         self.client = Client()
         self.client.login(username="shipper", password="test-pass-123")
         self.order = Order.objects.create(