Remove the guest system entirely: no is_guest/device_id, no guest throttles, phone login is the only way in

accounts.0008 drops the columns and refuses to run while guest rows exist.
Docs describe the current state; tests that only proved guest behaviour are gone.

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

progress/tests.py

@@ -23,7 +23,7 @@ class UserHeartsRegenTests(TestCase):
 
     def setUp(self):
         self.client = APIClient()
-        self.user = User.objects.create(device_id='dev-hearts-regen', is_guest=True, name='')
+        self.user = User.objects.create(phone='09000000001', name='')
         self.token = issue_access_token(self.user.id)
 
     def _get_hearts(self):
@@ -75,7 +75,7 @@ class CharacterGamificationTests(TestCase):
 
     def setUp(self):
         self.client = APIClient()
-        self.user = User.objects.create(device_id='device-characters-1', is_guest=True, name='')
+        self.user = User.objects.create(phone='09000000002', name='')
         self.token = issue_access_token(self.user.id)
 
         self.owl = Character.objects.create(slug='owl', name='جغد', icon='owl', unlock_xp=0, order=1)
@@ -275,7 +275,7 @@ class LeaderboardPeriodValidationTests(TestCase):
         from rest_framework.test import APIClient
 
         self.client = APIClient()
-        user = User.objects.create(device_id='lb-dev', is_guest=True)
+        user = User.objects.create(phone='09000000003')
         self.client.credentials(HTTP_AUTHORIZATION=f'Bearer {issue_access_token(user.id)}')
 
     def test_unknown_period_is_a_400(self):

progress/tests_weekly_report.py

@@ -46,8 +46,8 @@ class EstimateMinutesTests(SimpleTestCase):
 class WeeklyReportApiTests(TestCase):
     def setUp(self):
         cache.clear()
-        self.user = User.objects.create(phone='09120009001', is_guest=False)
-        self.other = User.objects.create(phone='09120009002', is_guest=False)
+        self.user = User.objects.create(phone='09120009001')
+        self.other = User.objects.create(phone='09120009002')
         grade = Grade.objects.create(title='پایه نهم', icon='', color='')
         node = Node.objects.create(unit=Unit.objects.create(grade=grade, title='فصل', order=1),
                                    title='جزیره', order=1)
@@ -139,12 +139,12 @@ class NodeProgressIsOwnOnlyTests(TestCase):
 
     def setUp(self):
         cache.clear()
-        self.user = User.objects.create(phone='09120009003', is_guest=False)
+        self.user = User.objects.create(phone='09120009003')
         self.client = APIClient()
         self.client.credentials(HTTP_AUTHORIZATION=f'Bearer {issue_access_token(self.user.id)}')
 
     def test_someone_elses_id_returns_only_your_own_progress(self):
-        other = User.objects.create(phone='09120009004', is_guest=False)
+        other = User.objects.create(phone='09120009004')
         node = Node.objects.create(
             unit=Unit.objects.create(grade=Grade.objects.create(title='پایه', icon='', color=''),
                                      title='فصل', order=1),

progress/views.py

@@ -9,21 +9,6 @@ from rest_framework.views import APIView
 
 from .models import Character, StreakRecord, UserHearts, UserStats
 from .services import effective_current_streak
-
-
-class GuestAwareReadThrottle(ScopedRateThrottle):
-    """همون الگوی GuestAwareContentThrottle: کاربرِ مهمان (هر deviceId یک pk
-    تازه) با IP کلید می‌خوره تا چرخشِ حساب سقفِ read رو دور نزنه."""
-
-    def get_cache_key(self, request, view):
-        user = request.user
-        if user and user.is_authenticated and getattr(user, 'is_guest', False):
-            ident = f'guest-ip:{self.get_ident(request)}'
-        elif user and user.is_authenticated:
-            ident = user.pk
-        else:
-            ident = self.get_ident(request)
-        return self.cache_format % {'scope': self.scope, 'ident': ident}
 from .serializers import (
     CharacterListResponseSerializer,
     LeaderboardResponseSerializer,
@@ -55,7 +40,7 @@ class UserSummaryView(APIView):
 
     permission_classes = [IsAuthenticated]
     throttle_scope = 'read'
-    throttle_classes = [GuestAwareReadThrottle]
+    throttle_classes = [ScopedRateThrottle]
 
     @extend_schema(responses=UserSummaryResponseSerializer, tags=['Progress & Gamification (progress)'])
     def get(self, request):
@@ -86,7 +71,7 @@ class StreakCalendarView(APIView):
 
     permission_classes = [IsAuthenticated]
     throttle_scope = 'read'
-    throttle_classes = [GuestAwareReadThrottle]
+    throttle_classes = [ScopedRateThrottle]
 
     @extend_schema(responses=StreakCalendarResponseSerializer, tags=['Progress & Gamification (progress)'])
     def get(self, request):
@@ -112,7 +97,7 @@ class WeeklyReportView(APIView):
 
     permission_classes = [IsAuthenticated]
     throttle_scope = 'read'
-    throttle_classes = [GuestAwareReadThrottle]
+    throttle_classes = [ScopedRateThrottle]
 
     @extend_schema(responses=WeeklyReportResponseSerializer, tags=['Progress & Gamification (progress)'])
     def get(self, request):
@@ -136,7 +121,7 @@ class LeaderboardView(APIView):
 
     permission_classes = [IsAuthenticated]
     throttle_scope = 'read'
-    throttle_classes = [GuestAwareReadThrottle]
+    throttle_classes = [ScopedRateThrottle]
 
     @extend_schema(
         parameters=[OpenApiParameter('period', OpenApiTypes.STR, required=False,
@@ -215,7 +200,7 @@ class CharacterListView(APIView):
 
     permission_classes = [IsAuthenticated]
     throttle_scope = 'read'
-    throttle_classes = [GuestAwareReadThrottle]
+    throttle_classes = [ScopedRateThrottle]
 
     @extend_schema(responses=CharacterListResponseSerializer, tags=['Progress & Gamification (progress)'])
     def get(self, request):