Security review: staff admin lockdown, unicode-safe login/phone/grade inputs, demo guest not upgradable, home cache not floodable

- accounts admin: phone/is_guest read-only for non-superusers, device_id filter lookups refused,
  auth.User/Group admin writable only by superusers
- campaigns: delivery log needs view permission
- phone/OTP/birth date: any Unicode digit normalised or rejected with 400; unknown gradeId is 400
- shared demo guest is never turned into a person's account by logging in
- /api/home with unknown gradeId is no longer cached (LocMemCache flood reset throttle counters)
- /api/progress/nodes: one query, huge unit is 400
- BazaarCredential token filter lookups refused

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

content/serializers.py

@@ -1,4 +1,3 @@
-from drf_spectacular.utils import extend_schema_field
 from rest_framework import serializers
 
 from .models import Grade, QuestionReport
@@ -215,15 +214,11 @@ class NodeProgressSerializer(serializers.Serializer):
         choices=['not_started', 'in_progress', 'completed', 'abandoned'],
     )
     lessonsCompleted = serializers.IntegerField(source='lessons_completed_count')
-    lessonsTotal = serializers.SerializerMethodField()
+    lessonsTotal = serializers.IntegerField(source='lessons_total')
     startedAt = serializers.DateTimeField(source='started_at', allow_null=True)
     completedAt = serializers.DateTimeField(source='completed_at', allow_null=True)
     lastActivityAt = serializers.DateTimeField(source='last_activity_at', allow_null=True)
 
-    @extend_schema_field(serializers.IntegerField)
-    def get_lessonsTotal(self, obj):
-        return obj.node.lessons.count()
-
 
 class NodeProgressListResponseSerializer(serializers.Serializer):
     progress = NodeProgressSerializer(many=True)