Remove guest login: every user registers with a phone number

POST /api/auth/session is gone (404). Existing is_guest rows keep refresh and
upgrade-by-phone until the demo/guest rows are purged; the code that serves
them is listed in docs/security-before-production.md §10. Tests that used the
endpoint as a fixture now use accounts/testing.guest_session.

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

accounts/management/commands/seed_test_data.py

@@ -89,7 +89,7 @@ class Command(BaseCommand):
             self.stdout.write(f'  - {label}: user_id={user.pk} phone={user.phone or "-"} token={token}')
         self.stdout.write(
             '\nنکته: این توکن‌ها با ACCESS_TOKEN_TTL_SECONDS فعلی امضا شدن و بعد از انقضا '
-            'باید دوباره seed یا از /api/auth/session یا /api/auth/login گرفته بشن.'
+            'باید دوباره seed یا از /api/auth/login گرفته بشن.'
         )
 
     # -- reset ----------------------------------------------------------