Remove guest login: every user registers with a phone number

POST /api/auth/session is gone (404). Existing is_guest rows keep refresh and
upgrade-by-phone until the demo/guest rows are purged; the code that serves
them is listed in docs/security-before-production.md §10. Tests that used the
endpoint as a fixture now use accounts/testing.guest_session.

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

accounts/tests_security_review.py

@@ -14,6 +14,7 @@ from django.utils import timezone
 from rest_framework.test import APIClient
 
 from accounts.authentication import issue_access_token
+from accounts.testing import guest_session
 from accounts.models import OTPCode, User
 from config.log_formatters import JSONLogFormatter
 
@@ -30,7 +31,7 @@ def _otp_row(phone, code='482913'):
 
 
 def _guest(device):
-    return APIClient().post('/api/auth/session', {'type': 'guest', 'deviceId': device}, format='json').json()
+    return guest_session(device)
 
 
 class GuestUpgradeRevokesEarlierSessionsTests(TestCase):