Remove the guest system entirely: no is_guest/device_id, no guest throttles, phone login is the only way in

accounts.0008 drops the columns and refuses to run while guest rows exist.
Docs describe the current state; tests that only proved guest behaviour are gone.

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

subscription/tests_security_review.py

@@ -20,7 +20,7 @@ class PaidPackWithDeletedPlanTests(TestCase):
 
     def test_order_snapshot_is_granted_even_if_plan_is_gone(self):
         cache.clear()
-        user = User.objects.create(phone='09120009902', is_guest=False)
+        user = User.objects.create(phone='09120009902')
         app = APIClient()
         app.credentials(HTTP_AUTHORIZATION=f'Bearer {issue_access_token(user.id)}')
         pack = Plan.objects.get(kind='pack', question_credits=20)