Security review: staff admin lockdown, unicode-safe login/phone/grade inputs, demo guest not upgradable, home cache not floodable

- accounts admin: phone/is_guest read-only for non-superusers, device_id filter lookups refused,
  auth.User/Group admin writable only by superusers
- campaigns: delivery log needs view permission
- phone/OTP/birth date: any Unicode digit normalised or rejected with 400; unknown gradeId is 400
- shared demo guest is never turned into a person's account by logging in
- /api/home with unknown gradeId is no longer cached (LocMemCache flood reset throttle counters)
- /api/progress/nodes: one query, huge unit is 400
- BazaarCredential token filter lookups refused

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

config/tests.py

@@ -174,6 +174,9 @@ class APIRequestLoggingMiddlewareTests(TestCase):
         user = User.objects.create(device_id='device-mw-log-1', is_guest=True, name='')
         token = issue_access_token(user.id)
 
+        from content.models import Grade
+        Grade.objects.create(pk=10, title='g10', icon='', color='')
+
         with self.assertLogs('config.middleware', level='INFO') as captured:
             response = self.client.post(
                 '/api/user/grade',