Remove guest login: every user registers with a phone number

POST /api/auth/session is gone (404). Existing is_guest rows keep refresh and
upgrade-by-phone until the demo/guest rows are purged; the code that serves
them is listed in docs/security-before-production.md §10. Tests that used the
endpoint as a fixture now use accounts/testing.guest_session.

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

accounts/schema.py

@@ -15,7 +15,7 @@ class TadrisinoTokenAuthenticationScheme(OpenApiAuthenticationExtension):
             'scheme': 'bearer',
             'bearerFormat': 'access_token',
             'description': (
-                'توکن دسترسی که از /api/auth/session یا /api/auth/login گرفته می‌شه. '
+                'توکن دسترسی که از /api/auth/login گرفته می‌شه. '
                 'در فیلد Value فقط خودِ توکن رو بذارید (بدون کلمه‌ی Bearer)؛ Swagger '
                 'خودش اضافه می‌کنه.'
             ),