Add shopper accounts, reviews, tracking, and seed_demo (#10)

## Summary
- Closes #9. Port shop-gated buyer accounts (register/login/profile, password reset, order history), purchase-gated reviews, and Stripe customer ids. Cards stay on Stripe.
- Slim public contact form to email + interest + message. Shipping tracking status, scan events, paste-in numbers, and EasyPost webhook when FEATURE_SHIPPING is on.
- Add template-neutral `seed_demo` (generic SKUs, demo shoppers, guest orders, tracking stubs). Prod refused. `--reset` deletes tagged demo rows after invoices.

## Test plan
- [ ] `cd site && uv run python manage.py test` (173 tests passed locally)
- [ ] Shop on: `/account/register`, login, profile, password reset, claim guest orders by email
- [ ] Shop off: `/account/` URLs absent; Sign in / Account links hidden
- [ ] Checkout as logged-in buyer stores `Order.user` and Stripe customer id; product review only after paid purchase
- [ ] Shipping on: portal paste-in tracking + EasyPost webhook updates status; shipping off: orders still work without tracking UI
- [ ] `seed_demo` refused in prod; `--reset` rebuilds tagged catalog/shoppers without deleting staff invoices

Reviewed-on: #10

site/shipping/migrations/0002_shipment_tracking.py

@@ -0,0 +1,54 @@
+# Generated by Django 6.1
+
+from django.db import migrations, models
+
+
+class Migration(migrations.Migration):
+
+    dependencies = [
+        ("shipping", "0001_initial"),
+    ]
+
+    operations = [
+        migrations.AddField(
+            model_name="shipment",
+            name="last_tracked_at",
+            field=models.DateTimeField(blank=True, null=True),
+        ),
+        migrations.AddField(
+            model_name="shipment",
+            name="tracker_id",
+            field=models.CharField(blank=True, max_length=255),
+        ),
+        migrations.AddField(
+            model_name="shipment",
+            name="tracking_events",
+            field=models.JSONField(blank=True, default=list),
+        ),
+        migrations.AddField(
+            model_name="shipment",
+            name="tracking_status",
+            field=models.CharField(
+                blank=True,
+                choices=[
+                    ("unknown", "Unknown"),
+                    ("pre_transit", "Pre-transit"),
+                    ("in_transit", "In transit"),
+                    ("out_for_delivery", "Out for delivery"),
+                    ("delivered", "Delivered"),
+                    ("available_for_pickup", "Available for pickup"),
+                    ("return_to_sender", "Return to sender"),
+                    ("failure", "Exception"),
+                    ("cancelled", "Cancelled"),
+                    ("error", "Error"),
+                ],
+                default="unknown",
+                max_length=32,
+            ),
+        ),
+        migrations.AddField(
+            model_name="shipment",
+            name="tracking_url",
+            field=models.URLField(blank=True),
+        ),
+    ]