Security review: staff admin lockdown, unicode-safe login/phone/grade inputs, demo guest not upgradable, home cache not floodable

- accounts admin: phone/is_guest read-only for non-superusers, device_id filter lookups refused,
  auth.User/Group admin writable only by superusers
- campaigns: delivery log needs view permission
- phone/OTP/birth date: any Unicode digit normalised or rejected with 400; unknown gradeId is 400
- shared demo guest is never turned into a person's account by logging in
- /api/home with unknown gradeId is no longer cached (LocMemCache flood reset throttle counters)
- /api/progress/nodes: one query, huge unit is 400
- BazaarCredential token filter lookups refused

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

accounts/jalali.py

@@ -81,10 +81,11 @@ def from_gregorian(d: date) -> tuple[int, int, int]:
 
 def parse(value: str) -> date:
     """«1385-04-12» (ارقامِ فارسی هم) → تاریخِ میلادی."""
-    from accounts.phone import _DIGITS
+    from accounts.phone import ascii_digits
 
-    parts = str(value).translate(_DIGITS).strip().replace('/', '-').split('-')
-    if len(parts) != 3 or not all(p.isdigit() for p in parts):
+    parts = ascii_digits(str(value)).strip().replace('/', '-').split('-')
+    # isascii: «²» برای isdigit رقم است ولی int() آن را نمی‌پذیرد (پیامِ خطای انگلیسیِ پایتون).
+    if len(parts) != 3 or not all(p.isascii() and p.isdigit() for p in parts):
         raise ValueError('تاریخ باید به شکلِ سال-ماه-روز باشد، مثلاً 1385-04-12.')
     return to_gregorian(int(parts[0]), int(parts[1]), int(parts[2]))