Remove guest login: every user registers with a phone number

POST /api/auth/session is gone (404). Existing is_guest rows keep refresh and
upgrade-by-phone until the demo/guest rows are purged; the code that serves
them is listed in docs/security-before-production.md §10. Tests that used the
endpoint as a fixture now use accounts/testing.guest_session.

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

accounts/serializers.py

@@ -45,11 +45,6 @@ class IranMobileField(serializers.CharField):
 
 # ---- Request serializers ----
 
-class GuestSessionRequestSerializer(serializers.Serializer):
-    type = serializers.ChoiceField(choices=['guest'])
-    deviceId = serializers.CharField(max_length=64)
-
-
 class OTPCodeField(serializers.CharField):
     """
     کدِ ورود: ۴ تا ۶ رقم (کدِ پیامکی ۶ رقمی است، کدهای TEST_LOGIN_PHONES ۴ تا ۶). رقمِ فارسی و
@@ -157,14 +152,6 @@ class RequestOTPRequestSerializer(serializers.Serializer):
 
 # ---- Response serializers ----
 
-class GuestSessionResponseSerializer(serializers.Serializer):
-    userId = serializers.CharField()
-    token = serializers.CharField()
-    refreshToken = serializers.CharField()
-    isNewUser = serializers.BooleanField()
-    isGuest = serializers.BooleanField()
-
-
 class LoginResponseSerializer(serializers.Serializer):
     userId = serializers.CharField()
     token = serializers.CharField()