Add shopper accounts, reviews, tracking, and seed_demo (#10)

## Summary
- Closes #9. Port shop-gated buyer accounts (register/login/profile, password reset, order history), purchase-gated reviews, and Stripe customer ids. Cards stay on Stripe.
- Slim public contact form to email + interest + message. Shipping tracking status, scan events, paste-in numbers, and EasyPost webhook when FEATURE_SHIPPING is on.
- Add template-neutral `seed_demo` (generic SKUs, demo shoppers, guest orders, tracking stubs). Prod refused. `--reset` deletes tagged demo rows after invoices.

## Test plan
- [ ] `cd site && uv run python manage.py test` (173 tests passed locally)
- [ ] Shop on: `/account/register`, login, profile, password reset, claim guest orders by email
- [ ] Shop off: `/account/` URLs absent; Sign in / Account links hidden
- [ ] Checkout as logged-in buyer stores `Order.user` and Stripe customer id; product review only after paid purchase
- [ ] Shipping on: portal paste-in tracking + EasyPost webhook updates status; shipping off: orders still work without tracking UI
- [ ] `seed_demo` refused in prod; `--reset` rebuilds tagged catalog/shoppers without deleting staff invoices

Reviewed-on: #10

site/shipping/models.py

@@ -11,6 +11,18 @@ class Shipment(UUIDPrimaryKeyModel, TimeStampedModel):
         LABELED = "labeled", "Labeled"
         VOID = "void", "Void"
 
+    class TrackingStatus(models.TextChoices):
+        UNKNOWN = "unknown", "Unknown"
+        PRE_TRANSIT = "pre_transit", "Pre-transit"
+        IN_TRANSIT = "in_transit", "In transit"
+        OUT_FOR_DELIVERY = "out_for_delivery", "Out for delivery"
+        DELIVERED = "delivered", "Delivered"
+        AVAILABLE_FOR_PICKUP = "available_for_pickup", "Available for pickup"
+        RETURN_TO_SENDER = "return_to_sender", "Return to sender"
+        FAILURE = "failure", "Exception"
+        CANCELLED = "cancelled", "Cancelled"
+        ERROR = "error", "Error"
+
     order = models.ForeignKey(Order, on_delete=models.PROTECT, related_name="shipments")
     status = models.CharField(
         max_length=16, choices=Status.choices, default=Status.DRAFT
@@ -18,6 +30,16 @@ class Shipment(UUIDPrimaryKeyModel, TimeStampedModel):
     carrier = models.CharField(max_length=32, blank=True)
     service = models.CharField(max_length=64, blank=True)
     tracking_number = models.CharField(max_length=64, blank=True)
+    tracking_status = models.CharField(
+        max_length=32,
+        choices=TrackingStatus.choices,
+        default=TrackingStatus.UNKNOWN,
+        blank=True,
+    )
+    tracking_url = models.URLField(blank=True)
+    tracker_id = models.CharField(max_length=255, blank=True)
+    tracking_events = models.JSONField(default=list, blank=True)
+    last_tracked_at = models.DateTimeField(null=True, blank=True)
     label_url = models.URLField(blank=True)
     rate_amount = models.DecimalField(max_digits=10, decimal_places=2, null=True, blank=True)
     currency = models.CharField(max_length=8, default="usd")