Add shopper accounts, reviews, tracking, and seed_demo (#10)

## Summary
- Closes #9. Port shop-gated buyer accounts (register/login/profile, password reset, order history), purchase-gated reviews, and Stripe customer ids. Cards stay on Stripe.
- Slim public contact form to email + interest + message. Shipping tracking status, scan events, paste-in numbers, and EasyPost webhook when FEATURE_SHIPPING is on.
- Add template-neutral `seed_demo` (generic SKUs, demo shoppers, guest orders, tracking stubs). Prod refused. `--reset` deletes tagged demo rows after invoices.

## Test plan
- [ ] `cd site && uv run python manage.py test` (173 tests passed locally)
- [ ] Shop on: `/account/register`, login, profile, password reset, claim guest orders by email
- [ ] Shop off: `/account/` URLs absent; Sign in / Account links hidden
- [ ] Checkout as logged-in buyer stores `Order.user` and Stripe customer id; product review only after paid purchase
- [ ] Shipping on: portal paste-in tracking + EasyPost webhook updates status; shipping off: orders still work without tracking UI
- [ ] `seed_demo` refused in prod; `--reset` rebuilds tagged catalog/shoppers without deleting staff invoices

Reviewed-on: #10

site/contacts/tests_merge.py

@@ -130,19 +130,12 @@ class ContactFormMergeTests(TestCase):
             ),
         )
 
-    def test_contact_form_merges_on_phone(self):
+    def test_contact_form_merges_on_email(self):
         url = reverse("public:contact")
         response = self.client.post(
             url,
             {
-                "first_name": "Alex",
-                "last_name": "Lee",
-                "email": "alt@example.com",
-                "phone": "(630) 111-2222",
-                "address_line1": "55 River Rd",
-                "address_city": "Aurora",
-                "address_state": "IL",
-                "address_zip": "60505",
+                "email": "primary@example.com",
                 "interest": "general",
                 "message": "Looking to buy",
             },
@@ -151,15 +144,33 @@ class ContactFormMergeTests(TestCase):
         self.assertEqual(Contact.objects.count(), 1)
         lead = Lead.objects.get()
         self.assertEqual(lead.contact_id, self.existing.pk)
-        self.assertIn("alt@example.com", lead.message)
-        self.assertIn("merged by phone", lead.message)
+        self.assertIn("Looking to buy", lead.message)
+
+    def test_contact_form_skips_name_phone_address(self):
+        url = reverse("public:contact")
+        response = self.client.post(
+            url,
+            {
+                "email": "newbuyer@example.com",
+                "interest": "quote",
+                "message": "Need a quote",
+                "first_name": "Ignored",
+                "phone": "6301112222",
+                "address_line1": "55 River Rd",
+            },
+        )
+        self.assertEqual(response.status_code, 302)
+        created = Contact.objects.get(email="newbuyer@example.com")
+        self.assertEqual(created.first_name, "")
+        self.assertEqual(created.phone, "")
+        self.assertEqual(created.postal_address, {})
 
 
 class PortalCreateMatchPromptTests(TestCase):
     def setUp(self):
         User = get_user_model()
         self.user = User.objects.create_user(
-            username="adder", password="test-pass-123"
+            username="adder", password="test-pass-123", is_staff=True
         )
         self.client = Client()
         self.client.login(username="adder", password="test-pass-123")