Add shopper accounts, reviews, tracking, and seed_demo (#10)

## Summary
- Closes #9. Port shop-gated buyer accounts (register/login/profile, password reset, order history), purchase-gated reviews, and Stripe customer ids. Cards stay on Stripe.
- Slim public contact form to email + interest + message. Shipping tracking status, scan events, paste-in numbers, and EasyPost webhook when FEATURE_SHIPPING is on.
- Add template-neutral `seed_demo` (generic SKUs, demo shoppers, guest orders, tracking stubs). Prod refused. `--reset` deletes tagged demo rows after invoices.

## Test plan
- [ ] `cd site && uv run python manage.py test` (173 tests passed locally)
- [ ] Shop on: `/account/register`, login, profile, password reset, claim guest orders by email
- [ ] Shop off: `/account/` URLs absent; Sign in / Account links hidden
- [ ] Checkout as logged-in buyer stores `Order.user` and Stripe customer id; product review only after paid purchase
- [ ] Shipping on: portal paste-in tracking + EasyPost webhook updates status; shipping off: orders still work without tracking UI
- [ ] `seed_demo` refused in prod; `--reset` rebuilds tagged catalog/shoppers without deleting staff invoices

Reviewed-on: #10

site/shipping/tests.py

@@ -1,4 +1,5 @@
 from decimal import Decimal
+import json
 
 from django.contrib.auth import get_user_model
 from django.test import Client, TestCase
@@ -49,11 +50,65 @@ class ShippingServiceTests(TestCase):
         buy_label(shipment)
         self.assertNotIn(self.order.number, pirate_ship_csv())
 
+    def test_stub_buy_sets_pre_transit_tracking(self):
+        shipment = create_shipment_for_order(self.order)
+        quote_rates(shipment)
+        buy_label(shipment)
+        shipment.refresh_from_db()
+        self.assertTrue(shipment.tracking_number)
+        self.assertEqual(shipment.tracking_status, Shipment.TrackingStatus.PRE_TRANSIT)
+        self.assertTrue(shipment.tracking_url)
+
+    def test_attach_tracking_from_pirate_ship(self):
+        from shipping.services import attach_tracking
+
+        shipment = create_shipment_for_order(self.order)
+        attach_tracking(shipment, tracking_number="9400111899223197428490", carrier="USPS")
+        shipment.refresh_from_db()
+        self.assertEqual(shipment.status, Shipment.Status.LABELED)
+        self.assertEqual(shipment.tracking_status, Shipment.TrackingStatus.PRE_TRANSIT)
+        self.assertIn("usps.com", shipment.tracking_url.lower())
+
+    def test_easypost_webhook_updates_status(self):
+        shipment = create_shipment_for_order(self.order)
+        shipment.tracking_number = "EZ1000000001"
+        shipment.status = Shipment.Status.LABELED
+        shipment.save()
+        payload = {
+            "description": "tracker.updated",
+            "result": {
+                "id": "trk_test",
+                "tracking_code": "EZ1000000001",
+                "status": "in_transit",
+                "public_url": "https://track.easypost.com/djE0",
+                "tracking_details": [
+                    {
+                        "status": "in_transit",
+                        "message": "Departed facility",
+                        "datetime": "2026-09-07T12:00:00Z",
+                        "tracking_location": {"city": "Chicago", "state": "IL"},
+                    }
+                ],
+            },
+        }
+        response = Client().post(
+            reverse("shipping:easypost_webhook"),
+            data=json.dumps(payload),
+            content_type="application/json",
+        )
+        self.assertEqual(response.status_code, 200)
+        shipment.refresh_from_db()
+        self.assertEqual(shipment.tracking_status, Shipment.TrackingStatus.IN_TRANSIT)
+        self.assertEqual(shipment.tracker_id, "trk_test")
+        self.assertEqual(shipment.tracking_events[0]["location"], "Chicago IL")
+
 
 class ShippingPortalTests(TestCase):
     def setUp(self):
         User = get_user_model()
-        self.user = User.objects.create_user("shipper", password="test-pass-123")
+        self.user = User.objects.create_user(
+            "shipper", password="test-pass-123", is_staff=True
+        )
         self.client = Client()
         self.client.login(username="shipper", password="test-pass-123")
         self.order = Order.objects.create(