Customer accounts, order tracking, and purchase reviews (#8)

## Summary
- Slim the public contact form to email, interest, and message. Name, phone, and address live on the customer profile instead.
- Customers can register, sign in, save shipping details, and view order history. Logged-in checkout creates a Stripe Customer and saves cards on Stripe (`setup_future_usage`); we only store `stripe_customer_id`.
- Shipment tracking: EasyPost tracker lookup + webhook, plus paste-in numbers from Pirate Ship/Shippo. Customers see carrier status on their orders; `dispatch_due` refreshes open shipments.
- Product reviews (1–5) only after a paid/fulfilled purchase of that product.

Fixes #7

## Test plan
- [ ] Contact form submits with only email + message; extra name/phone/address fields are ignored
- [ ] Register, sign in, save profile (name/phone/shipping)
- [ ] Guest checkout still works; after signup, prior orders with that email show in history
- [ ] Logged-in checkout prefills shipping and does not collect card data locally
- [ ] Portal: buy label or paste a Pirate Ship tracking number, confirm status/events; customer order page shows tracking
- [ ] Product page: non-buyers cannot review; buyers can leave one 1–5 star review
- [ ] Non-staff users hitting `/portal/` redirect to `/account/`

Reviewed-on: #8

site/shipping/urls.py

@@ -8,6 +8,17 @@ urlpatterns = [
     path("", views.shipment_list, name="shipment_list"),
     path("new/", views.shipment_create, name="shipment_create"),
     path("export/pirate-ship.csv", views.pirate_ship_export, name="pirate_ship_export"),
+    path("webhooks/easypost/", views.easypost_webhook, name="easypost_webhook"),
     path("<uuid:pk>/", views.shipment_detail, name="shipment_detail"),
     path("<uuid:pk>/buy/", views.shipment_buy, name="shipment_buy"),
+    path(
+        "<uuid:pk>/tracking/",
+        views.shipment_attach_tracking,
+        name="shipment_attach_tracking",
+    ),
+    path(
+        "<uuid:pk>/tracking/refresh/",
+        views.shipment_refresh_tracking,
+        name="shipment_refresh_tracking",
+    ),
 ]