Remove the guest system entirely: no is_guest/device_id, no guest throttles, phone login is the only way in

accounts.0008 drops the columns and refuses to run while guest rows exist.
Docs describe the current state; tests that only proved guest behaviour are gone.

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

content/tests_security_review.py

@@ -33,7 +33,7 @@ class SupervisorCannotEditContentTests(TestCase):
         self.q = Question.objects.create(lesson=self.lesson, type='multiple_choice', prompt='p?')
         ok = Choice.objects.create(question=self.q, value='1', is_correct=True)
         Choice.objects.create(question=self.q, value='2', is_correct=False)
-        self.student = User.objects.create(phone='09120009999', is_guest=False)
+        self.student = User.objects.create(phone='09120009999')
         UserAnswer.objects.create(user_id=self.student.id, question=self.q, choice=ok, correct=True)
 
     def test_question_import_with_replace_is_refused(self):
@@ -64,7 +64,7 @@ class NonAsciiDigitsAre400Tests(TestCase):
 
     def setUp(self):
         cache.clear()
-        user = User.objects.create(device_id='digits', is_guest=True)
+        user = User.objects.create(phone='09000000010')
         self.app = APIClient()
         self.app.credentials(HTTP_AUTHORIZATION=f'Bearer {issue_access_token(user.id)}')
 
@@ -97,7 +97,7 @@ class JunkGradeIdsDoNotFlushCacheTests(TestCase):
         patcher = mock.patch.dict(ScopedRateThrottle.THROTTLE_RATES, {'read': '100000/min'})
         patcher.start()
         self.addCleanup(patcher.stop)
-        user = User.objects.create(phone='09120009911', is_guest=False)
+        user = User.objects.create(phone='09120009911')
         self.app = APIClient()
         self.app.credentials(HTTP_AUTHORIZATION=f'Bearer {issue_access_token(user.id)}')
 
@@ -122,7 +122,7 @@ class ProgressNodesInputAndQueriesTests(TestCase):
 
     def setUp(self):
         cache.clear()
-        self.user = User.objects.create(phone='09120009912', is_guest=False)
+        self.user = User.objects.create(phone='09120009912')
         self.app = APIClient()
         self.app.credentials(HTTP_AUTHORIZATION=f'Bearer {issue_access_token(self.user.id)}')