Add shopper accounts, reviews, tracking, and seed_demo (#10)

## Summary
- Closes #9. Port shop-gated buyer accounts (register/login/profile, password reset, order history), purchase-gated reviews, and Stripe customer ids. Cards stay on Stripe.
- Slim public contact form to email + interest + message. Shipping tracking status, scan events, paste-in numbers, and EasyPost webhook when FEATURE_SHIPPING is on.
- Add template-neutral `seed_demo` (generic SKUs, demo shoppers, guest orders, tracking stubs). Prod refused. `--reset` deletes tagged demo rows after invoices.

## Test plan
- [ ] `cd site && uv run python manage.py test` (173 tests passed locally)
- [ ] Shop on: `/account/register`, login, profile, password reset, claim guest orders by email
- [ ] Shop off: `/account/` URLs absent; Sign in / Account links hidden
- [ ] Checkout as logged-in buyer stores `Order.user` and Stripe customer id; product review only after paid purchase
- [ ] Shipping on: portal paste-in tracking + EasyPost webhook updates status; shipping off: orders still work without tracking UI
- [ ] `seed_demo` refused in prod; `--reset` rebuilds tagged catalog/shoppers without deleting staff invoices

Reviewed-on: #10

site/client_site/settings/base.py

@@ -183,6 +183,7 @@ MIDDLEWARE = [
     "django.middleware.common.CommonMiddleware",
     "django.middleware.csrf.CsrfViewMiddleware",
     "django.contrib.auth.middleware.AuthenticationMiddleware",
+    "accounts.middleware.PortalStaffMiddleware",
     "django.contrib.messages.middleware.MessageMiddleware",
     "django.middleware.clickjacking.XFrameOptionsMiddleware",
     "analytics.middleware.UTMTrackingMiddleware",
@@ -381,6 +382,7 @@ POS_WEBHOOK_SECRET = env("POS_WEBHOOK_SECRET", "")
 POS_API_BASE_URL = env("POS_API_BASE_URL", "")
 POS_API_TOKEN = env("POS_API_TOKEN", "")
 EASYPOST_API_KEY = env("EASYPOST_API_KEY", "")
+EASYPOST_WEBHOOK_SECRET = env("EASYPOST_WEBHOOK_SECRET", "")
 SHIP_FROM_LINE1 = env("SHIP_FROM_LINE1", "")
 SHIP_FROM_CITY = env("SHIP_FROM_CITY", "")
 SHIP_FROM_STATE = env("SHIP_FROM_STATE", "")

site/client_site/templates/base.html

@@ -90,6 +90,19 @@
                   <a class="rd-nav-link" href="{% url item.url_name %}">{{ item.label }}</a>
                 </li>
                 {% endfor %}
+                {% if user.is_authenticated %}
+                <li class="rd-nav-item">
+                  {% if user.is_staff %}
+                  <a class="rd-nav-link" href="{% url 'dashboard:home' %}">Portal</a>
+                  {% elif "shop" in enabled_features %}
+                  <a class="rd-nav-link" href="{% url 'account:home' %}">Account</a>
+                  {% endif %}
+                </li>
+                {% elif "shop" in enabled_features %}
+                <li class="rd-nav-item">
+                  <a class="rd-nav-link" href="{% url 'account:login' %}">Sign in</a>
+                </li>
+                {% endif %}
               </ul>
             </div>
           </div>
@@ -134,9 +147,14 @@
               {% for item in public_nav_extra %}
               <li><a href="{% url item.url_name %}">{{ item.label }}</a></li>
               {% endfor %}
-              {% if user.is_authenticated %}
+              {% if user.is_authenticated and not user.is_staff and "shop" in enabled_features %}
+              <li><a href="{% url 'account:home' %}">Account</a></li>
+              {% elif user.is_authenticated %}
               <li><a href="{% url 'dashboard:home' %}">Client portal</a></li>
               {% else %}
+              {% if "shop" in enabled_features %}
+              <li><a href="{% url 'account:login' %}">Sign in</a></li>
+              {% endif %}
               <li><a href="{% url 'accounts:login' %}">Client portal</a></li>
               {% endif %}
             </ul>

site/client_site/urls.py

@@ -50,6 +50,7 @@ if apps.is_installed("social_ai"):
     ]
 if apps.is_installed("shop"):
     urlpatterns += [
+        path("account/", include("accounts.customer_urls")),
         path("shop/", include("shop.public_urls")),
         path("portal/shop/", include("shop.portal_urls")),
     ]