Remove guest login: every user registers with a phone number

POST /api/auth/session is gone (404). Existing is_guest rows keep refresh and
upgrade-by-phone until the demo/guest rows are purged; the code that serves
them is listed in docs/security-before-production.md §10. Tests that used the
endpoint as a fixture now use accounts/testing.guest_session.

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

accounts/tests_audit_fixes.py

@@ -9,6 +9,7 @@ from django.test import TestCase, override_settings
 from rest_framework.test import APIClient
 
 from accounts.authentication import issue_access_token
+from accounts.testing import guest_session
 from accounts.models import OTPCode, User
 from content.models import Choice, Grade, Lesson, Node, Question, Unit
 from progress.models import UserHearts, UserStats
@@ -25,8 +26,7 @@ class LogoutTests(TestCase):
         cache.clear()
 
     def test_logout_kills_the_current_token_and_its_refresh(self):
-        guest = APIClient().post('/api/auth/session', {'type': 'guest', 'deviceId': 'dev-out'},
-                                 format='json').json()
+        guest = guest_session('dev-out')
         client = APIClient()
         client.credentials(HTTP_AUTHORIZATION=f'Bearer {guest["token"]}')
         self.assertEqual(client.get('/api/user/profile').status_code, 200)
@@ -40,8 +40,7 @@ class LogoutTests(TestCase):
         self.assertEqual(refreshed.status_code, 401)
 
         # ورودِ دوباره کار می‌کند
-        again = APIClient().post('/api/auth/session', {'type': 'guest', 'deviceId': 'dev-out'},
-                                 format='json').json()
+        again = guest_session('dev-out')
         fresh = APIClient()
         fresh.credentials(HTTP_AUTHORIZATION=f'Bearer {again["token"]}')
         self.assertEqual(fresh.get('/api/user/profile').status_code, 200)
@@ -72,8 +71,7 @@ class OtpTests(TestCase):
 class GuestSignupKeepsProgressTests(TestCase):
     def setUp(self):
         cache.clear()
-        guest = APIClient().post('/api/auth/session', {'type': 'guest', 'deviceId': 'dev-up'},
-                                 format='json').json()
+        guest = guest_session('dev-up')
         self.guest_id = int(guest['userId'])
         UserStats.objects.create(user_id=self.guest_id, xp=120)
         self.client = APIClient()