Add campaign UTM links and piha.li shortener (#4)

## Summary
- Port Monica campaign UTM + piha.li minting into always-on `core` (`shortener.py`, `campaign_utm.py`) so `email_sms` and `directmail` stay optional and never import each other.
- `utm_source` is a slug of `SITE_NAME` (override with `UTM_SOURCE`). Email gets an HTML `data-campaign-utm` link; SMS gets a plain URL; postcard QR only — no body inject.
- Live composer mints through login+CSRF `POST /portal/campaigns/short-link/` (registered only when an outreach app is installed). Empty `SHORTENER_*` falls back to the long UTM URL.

Reference: [monica_site PR #10](ai_ml_operations/monica_site#10)

Closes #3

## Test plan
- [x] `cd site && uv run python manage.py test` (125 tests)
- [ ] Email composer: type a name, confirm HTML link + `utm_campaign` updates, save draft
- [ ] SMS composer: plain `piha.li` (or long UTM if shortener unset) in the body
- [ ] Postcard composer: QR copies the tracked URL; campaign body has no `utm_source`
- [ ] Campaign report pages show the same panel
- [ ] With `FEATURE_EMAIL_SMS` and `FEATURE_DIRECT_MAIL` off, no extra nav and no `/portal/campaigns/short-link/` route

Reviewed-on: #4

.env.prod.example

@@ -73,6 +73,14 @@ OLLAMA_BASE_URL=http://10.0.0.128:11434
 OLLAMA_MODEL=llama3.2
 OLLAMA_TIMEOUT_SECONDS=120
 
+# Required in beta/prod when FEATURE_EMAIL_SMS or FEATURE_DIRECT_MAIL is on.
+# POST /api/links/ on the API host. Recipients hit https://piha.li/<code>.
+# Token must match SHORTENER_API_TOKENS on url_shortening_service (name:secret).
+# Generate: python -c "import secrets; print(secrets.token_urlsafe(32))"
+SHORTENER_BASE_URL=https://shortener.aimloperations.com
+SHORTENER_API_TOKEN=acme:replace-me
+# UTM_SOURCE=acme  # optional; default is a slug of SITE_NAME
+
 NOMINATIM_BASE_URL=http://10.0.0.128:8089
 NOMINATIM_TIMEOUT_SECONDS=8
 NOMINATIM_COUNTRY_CODES=us
@@ -90,3 +98,5 @@ GUNICORN_BIND=0.0.0.0:8000
 # PUBLIC_SITE_URL=https://example-preview.aimloperations.com
 # DATABASE_URL=postgres://westfarn:replace-db-password@10.0.0.230:5432/client_site_beta
 # WEB_PORT=8014
+# SHORTENER_BASE_URL=https://shortener-beta.aimloperations.com
+# SHORTENER_API_TOKEN=acme:replace-with-a-different-token