Add campaign UTM links and piha.li shortener (#4)

## Summary
- Port Monica campaign UTM + piha.li minting into always-on `core` (`shortener.py`, `campaign_utm.py`) so `email_sms` and `directmail` stay optional and never import each other.
- `utm_source` is a slug of `SITE_NAME` (override with `UTM_SOURCE`). Email gets an HTML `data-campaign-utm` link; SMS gets a plain URL; postcard QR only — no body inject.
- Live composer mints through login+CSRF `POST /portal/campaigns/short-link/` (registered only when an outreach app is installed). Empty `SHORTENER_*` falls back to the long UTM URL.

Reference: [monica_site PR #10](ai_ml_operations/monica_site#10)

Closes #3

## Test plan
- [x] `cd site && uv run python manage.py test` (125 tests)
- [ ] Email composer: type a name, confirm HTML link + `utm_campaign` updates, save draft
- [ ] SMS composer: plain `piha.li` (or long UTM if shortener unset) in the body
- [ ] Postcard composer: QR copies the tracked URL; campaign body has no `utm_source`
- [ ] Campaign report pages show the same panel
- [ ] With `FEATURE_EMAIL_SMS` and `FEATURE_DIRECT_MAIL` off, no extra nav and no `/portal/campaigns/short-link/` route

Reviewed-on: #4

site/core/views.py

@@ -1,9 +1,12 @@
 import io
+import json
 
+from django.contrib.auth.decorators import login_required
 from django.http import FileResponse, JsonResponse
 from django.shortcuts import get_object_or_404
-from django.views.decorators.http import require_GET
+from django.views.decorators.http import require_GET, require_POST
 
+from core.campaign_utm import resolve_campaign_tracked_url
 from core.models import StoredFile
 
 
@@ -24,3 +27,40 @@ def stored_file(request, pk):
         response["Content-Disposition"] = f'inline; filename="{stored.filename}"'
     response["Cache-Control"] = "public, max-age=86400"
     return response
+
+
+@login_required
+@require_POST
+def campaign_short_link(request):
+    """Mint (or reuse) a short URL for the campaign tracked landing link.
+
+    Browser talks to this portal endpoint only. The shortener is server-to-server.
+    Does not import optional campaign apps — campaign_id is only an external_ref.
+    """
+    try:
+        payload = json.loads(request.body.decode() or "{}")
+    except (json.JSONDecodeError, UnicodeDecodeError):
+        payload = {}
+    if not isinstance(payload, dict):
+        payload = {}
+    name = (payload.get("name") or request.POST.get("name") or "").strip()
+    medium = (payload.get("medium") or request.POST.get("medium") or "").strip()
+    campaign_id = (
+        payload.get("campaign_id") or request.POST.get("campaign_id") or ""
+    )
+    campaign_id = str(campaign_id).strip() or None
+    target, display = resolve_campaign_tracked_url(
+        name=name or "campaign",
+        medium=medium,
+        campaign_id=campaign_id,
+        user_id=getattr(request.user, "pk", None),
+        shorten=True,
+    )
+    return JsonResponse(
+        {
+            "target_url": target,
+            "short_url": display if display != target else "",
+            "display_url": display,
+            "shortened": display != target,
+        }
+    )