Remove guest login: every user registers with a phone number

POST /api/auth/session is gone (404). Existing is_guest rows keep refresh and
upgrade-by-phone until the demo/guest rows are purged; the code that serves
them is listed in docs/security-before-production.md §10. Tests that used the
endpoint as a fixture now use accounts/testing.guest_session.

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

config/tests.py

@@ -202,18 +202,18 @@ class APIRequestLoggingMiddlewareTests(TestCase):
     def test_anonymous_api_request_is_logged_with_null_user_id(self):
         with self.assertLogs('config.middleware', level='INFO') as captured:
             response = self.client.post(
-                '/api/auth/session',
-                {'type': 'guest', 'deviceId': 'device-mw-log-anon-1'},
+                '/api/auth/refresh',
+                {'refreshToken': 'not-a-real-token'},
                 format='json',
             )
 
-        self.assertEqual(response.status_code, 200)
+        self.assertEqual(response.status_code, 401)
         self.assertEqual(len(captured.records), 1)
         message = captured.records[0].getMessage()
 
         self.assertIn('method=POST', message)
-        self.assertIn('path=/api/auth/session', message)
-        self.assertIn('status=200', message)
+        self.assertIn('path=/api/auth/refresh', message)
+        self.assertIn('status=401', message)
         self.assertIn('user_id=None', message)
 
     def test_non_api_request_is_not_logged(self):