Add shopper accounts, reviews, tracking, and seed_demo (#10)

## Summary
- Closes #9. Port shop-gated buyer accounts (register/login/profile, password reset, order history), purchase-gated reviews, and Stripe customer ids. Cards stay on Stripe.
- Slim public contact form to email + interest + message. Shipping tracking status, scan events, paste-in numbers, and EasyPost webhook when FEATURE_SHIPPING is on.
- Add template-neutral `seed_demo` (generic SKUs, demo shoppers, guest orders, tracking stubs). Prod refused. `--reset` deletes tagged demo rows after invoices.

## Test plan
- [ ] `cd site && uv run python manage.py test` (173 tests passed locally)
- [ ] Shop on: `/account/register`, login, profile, password reset, claim guest orders by email
- [ ] Shop off: `/account/` URLs absent; Sign in / Account links hidden
- [ ] Checkout as logged-in buyer stores `Order.user` and Stripe customer id; product review only after paid purchase
- [ ] Shipping on: portal paste-in tracking + EasyPost webhook updates status; shipping off: orders still work without tracking UI
- [ ] `seed_demo` refused in prod; `--reset` rebuilds tagged catalog/shoppers without deleting staff invoices

Reviewed-on: #10

site/email_sms/tests.py

@@ -123,8 +123,7 @@ class PortalConsentToggleTests(TestCase):
     def setUp(self):
         User = get_user_model()
         self.user = User.objects.create_user(
-            username="monica", password="test-pass-123"
-        )
+            username="monica", password="test-pass-123", is_staff=True)
         self.client = Client()
         self.client.login(username="monica", password="test-pass-123")
         self.contact = Contact.objects.create(
@@ -190,8 +189,7 @@ class CampaignDraftSaveTests(TestCase):
     def setUp(self):
         User = get_user_model()
         self.user = User.objects.create_user(
-            username="composer", password="test-pass-123"
-        )
+            username="composer", password="test-pass-123", is_staff=True)
         self.client = Client()
         self.client.login(username="composer", password="test-pass-123")
         self.contact = Contact.objects.create(
@@ -260,8 +258,7 @@ class CampaignSendTests(TestCase):
     def setUp(self):
         User = get_user_model()
         self.user = User.objects.create_user(
-            username="sender", password="test-pass-123", email="sender@example.com"
-        )
+            username="sender", password="test-pass-123", email="sender@example.com", is_staff=True)
         self.client = Client()
         self.client.login(username="sender", password="test-pass-123")
         self.contact = Contact.objects.create(
@@ -467,7 +464,7 @@ class Smtp2goEmailWebhookTests(TestCase):
 
     def test_status_json_includes_opens(self):
         User = get_user_model()
-        user = User.objects.create_user(username="viewer", password="test-pass-123")
+        user = User.objects.create_user(username="viewer", password="test-pass-123", is_staff=True)
         self.client.login(username="viewer", password="test-pass-123")
         ProviderEvent.objects.create(
             message=self.message,
@@ -946,8 +943,7 @@ class StoredFileUploadTests(TestCase):
     def setUp(self):
         User = get_user_model()
         self.user = User.objects.create_user(
-            username="uploader", password="test-pass-123"
-        )
+            username="uploader", password="test-pass-123", is_staff=True)
         self.client = Client()
         self.client.login(username="uploader", password="test-pass-123")
 
@@ -1030,8 +1026,7 @@ class CampaignRecipientTableTests(TestCase):
 
         User = get_user_model()
         self.user = User.objects.create_user(
-            username="recip", password="test-pass-123"
-        )
+            username="recip", password="test-pass-123", is_staff=True)
         self.client = Client()
         self.client.login(username="recip", password="test-pass-123")
         self.contacts = []
@@ -1169,8 +1164,7 @@ class CampaignUtmLinkTests(TestCase):
     def setUp(self):
         User = get_user_model()
         self.user = User.objects.create_user(
-            username="utm-composer", password="test-pass-123"
-        )
+            username="utm-composer", password="test-pass-123", is_staff=True)
         self.client = Client()
         self.client.login(username="utm-composer", password="test-pass-123")
         self.contact = Contact.objects.create(