Remove the guest system entirely: no is_guest/device_id, no guest throttles, phone login is the only way in

accounts.0008 drops the columns and refuses to run while guest rows exist.
Docs describe the current state; tests that only proved guest behaviour are gone.

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

ai_tutor/tests_security_review.py

@@ -60,7 +60,7 @@ class _Base(TestCase):
     def setUp(self):
         cache.clear()
         reset_clients_cache()
-        self.user = User.objects.create(phone='09120009901', is_guest=False)
+        self.user = User.objects.create(phone='09120009901')
         self.c = APIClient()
         self.c.credentials(HTTP_AUTHORIZATION=f'Bearer {issue_access_token(self.user.id)}')
 
@@ -97,7 +97,7 @@ class LateOffTopicMarkerTests(_Base):
         q = 'سوال درباره‌ی چیزی'
         with patch('rag.services.clients.get_openai_client', return_value=fake):
             streamed = ''.join(d['delta'] for e, d in sse(self.ask(q, stream=True)) if e == 'chunk')
-            other = User.objects.create(phone='09120009902', is_guest=False)
+            other = User.objects.create(phone='09120009902')
             c2 = APIClient()
             c2.credentials(HTTP_AUTHORIZATION=f'Bearer {issue_access_token(other.id)}')
             second = c2.post('/api/ai/ask', {'userQuestion': q}, format='json')