Add shopper accounts, reviews, tracking, and seed_demo (#10)

## Summary
- Closes #9. Port shop-gated buyer accounts (register/login/profile, password reset, order history), purchase-gated reviews, and Stripe customer ids. Cards stay on Stripe.
- Slim public contact form to email + interest + message. Shipping tracking status, scan events, paste-in numbers, and EasyPost webhook when FEATURE_SHIPPING is on.
- Add template-neutral `seed_demo` (generic SKUs, demo shoppers, guest orders, tracking stubs). Prod refused. `--reset` deletes tagged demo rows after invoices.

## Test plan
- [ ] `cd site && uv run python manage.py test` (173 tests passed locally)
- [ ] Shop on: `/account/register`, login, profile, password reset, claim guest orders by email
- [ ] Shop off: `/account/` URLs absent; Sign in / Account links hidden
- [ ] Checkout as logged-in buyer stores `Order.user` and Stripe customer id; product review only after paid purchase
- [ ] Shipping on: portal paste-in tracking + EasyPost webhook updates status; shipping off: orders still work without tracking UI
- [ ] `seed_demo` refused in prod; `--reset` rebuilds tagged catalog/shoppers without deleting staff invoices

Reviewed-on: #10

site/core/tests_features.py

@@ -122,9 +122,11 @@ class InstalledOptionalAppsTests(TestCase):
         self.assertTrue(reverse("social:composer").startswith("/portal/social/"))
         self.assertTrue(reverse("social_ai:generate").startswith("/portal/social/api/generate/"))
         self.assertTrue(reverse("shop:list").startswith("/shop/"))
+        self.assertTrue(reverse("account:login").startswith("/account/"))
         self.assertTrue(reverse("shop_portal:product_list").startswith("/portal/shop/"))
         self.assertTrue(reverse("shop_portal:sales").startswith("/portal/shop/sales/"))
         self.assertTrue(reverse("pos_sync:event_list").startswith("/portal/pos/"))
         self.assertTrue(reverse("events:list").startswith("/events/"))
         self.assertTrue(reverse("events_portal:event_list").startswith("/portal/events/"))
         self.assertTrue(reverse("shipping:shipment_list").startswith("/portal/shipping/"))
+        self.assertTrue(reverse("shipping:easypost_webhook").startswith("/portal/shipping/webhooks/"))