Remove guest login: every user registers with a phone number

POST /api/auth/session is gone (404). Existing is_guest rows keep refresh and
upgrade-by-phone until the demo/guest rows are purged; the code that serves
them is listed in docs/security-before-production.md §10. Tests that used the
endpoint as a fixture now use accounts/testing.guest_session.

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

accounts/urls.py

@@ -2,7 +2,6 @@ from django.urls import path
 
 from .views import (
     DeleteAccountView,
-    GuestSessionView,
     LoginView,
     LogoutView,
     RefreshTokenView,
@@ -12,7 +11,6 @@ from .views import (
 )
 
 urlpatterns = [
-    path('auth/session', GuestSessionView.as_view(), name='auth-session'),
     path('auth/otp/request', RequestOTPView.as_view(), name='auth-otp-request'),
     path('auth/login', LoginView.as_view(), name='auth-login'),
     path('auth/refresh', RefreshTokenView.as_view(), name='auth-refresh'),