Add campaign UTM links and piha.li shortener (#4)

## Summary
- Port Monica campaign UTM + piha.li minting into always-on `core` (`shortener.py`, `campaign_utm.py`) so `email_sms` and `directmail` stay optional and never import each other.
- `utm_source` is a slug of `SITE_NAME` (override with `UTM_SOURCE`). Email gets an HTML `data-campaign-utm` link; SMS gets a plain URL; postcard QR only — no body inject.
- Live composer mints through login+CSRF `POST /portal/campaigns/short-link/` (registered only when an outreach app is installed). Empty `SHORTENER_*` falls back to the long UTM URL.

Reference: [monica_site PR #10](ai_ml_operations/monica_site#10)

Closes #3

## Test plan
- [x] `cd site && uv run python manage.py test` (125 tests)
- [ ] Email composer: type a name, confirm HTML link + `utm_campaign` updates, save draft
- [ ] SMS composer: plain `piha.li` (or long UTM if shortener unset) in the body
- [ ] Postcard composer: QR copies the tracked URL; campaign body has no `utm_source`
- [ ] Campaign report pages show the same panel
- [ ] With `FEATURE_EMAIL_SMS` and `FEATURE_DIRECT_MAIL` off, no extra nav and no `/portal/campaigns/short-link/` route

Reviewed-on: #4

README.md

@@ -61,3 +61,23 @@ server-infra Ansible deploy.
 
 Ollama for social drafts lives on the LAN at `http://10.0.0.128:11434`.
 Do not call a public Ollama host.
+
+## Campaign tracked links (piha.li)
+
+When `FEATURE_EMAIL_SMS` or `FEATURE_DIRECT_MAIL` is on, composers auto-insert a
+homepage URL with `utm_source` (slug of `SITE_NAME`, or `UTM_SOURCE`),
+`utm_medium` = channel, and `utm_campaign` = campaign name. Configured
+`SHORTENER_BASE_URL` + `SHORTENER_API_TOKEN` mint that URL via
+[url_shortening_service](https://git.aimloperations.com/ai_ml_operations/url_shortening_service)
+and put `piha.li` / `beta.piha.li` short links in SMS, email hrefs, and postcard QR codes.
+
+Caller secrets (this repo's env file):
+
+```text
+SHORTENER_BASE_URL=https://shortener.aimloperations.com
+SHORTENER_API_TOKEN=<slug>:<secret>
+```
+
+Operator secrets (`url_shortening_service_*`): `SHORTENER_API_TOKENS=<slug>:<same-secret>`
+and `SHORT_ALLOWED_HOSTS` must include the client domain. Mint against the **API host**,
+never `piha.li`.