Remove guest login: every user registers with a phone number

POST /api/auth/session is gone (404). Existing is_guest rows keep refresh and
upgrade-by-phone until the demo/guest rows are purged; the code that serves
them is listed in docs/security-before-production.md §10. Tests that used the
endpoint as a fixture now use accounts/testing.guest_session.

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

content/tests_flow.py

@@ -13,6 +13,7 @@ from django.test import TestCase
 from rest_framework.test import APIClient
 
 from accounts.models import User
+from accounts.testing import guest_session
 from content.models import Choice, Grade, Lesson, Node, Question, Unit
 
 
@@ -45,12 +46,9 @@ class BasicLearningFlowTests(TestCase):
         self.client.credentials(HTTP_AUTHORIZATION=f'Bearer {token}')
 
     def test_a_new_user_can_go_from_signup_to_finishing_a_lesson(self):
-        # ۱. ورودِ مهمان — سریع‌ترین مسیرِ ورود که اپ می‌تواند بگیرد.
-        response = self.client.post(
-            '/api/auth/session', {'type': 'guest', 'deviceId': 'flow-device-1'}, format='json',
-        )
-        self.assertEqual(response.status_code, 200, response.data)
-        self._auth(response.data['token'])
+        # ۱. حسابِ مهمانِ قدیمی (ورودِ مهمان حذف شده؛ این ردیف‌ها هنوز هستند).
+        session = guest_session('flow-device-1')
+        self._auth(session['token'])
 
         # ۲. صفحه‌ی «بیا باهم آشنا بشیم»: اسم + پایه.
         response = self.client.patch('/api/user/profile', {'name': 'سارا'}, format='json')
@@ -112,10 +110,8 @@ class BasicLearningFlowTests(TestCase):
     def test_completing_twice_with_the_same_key_does_not_double_count(self):
         from content.models import UserLessonCompletion
 
-        response = self.client.post(
-            '/api/auth/session', {'type': 'guest', 'deviceId': 'flow-device-2'}, format='json',
-        )
-        self._auth(response.data['token'])
+        session = guest_session('flow-device-2')
+        self._auth(session['token'])
         self.client.post('/api/user/grade', {'gradeId': self.grade.id}, format='json')
         self.client.post(
             f'/api/questions/{self.question.id}/answer',
@@ -148,10 +144,8 @@ class BasicLearningFlowTests(TestCase):
         به‌روز می‌شود. بدونِ دانستنِ این، توسعه‌دهنده‌ی فرانت دنبالِ باگی
         می‌گردد که وجود ندارد.
         """
-        response = self.client.post(
-            '/api/auth/session', {'type': 'guest', 'deviceId': 'flow-device-4'}, format='json',
-        )
-        self._auth(response.data['token'])
+        session = guest_session('flow-device-4')
+        self._auth(session['token'])
         self.client.post('/api/user/grade', {'gradeId': self.grade.id}, format='json')
 
         answer = self.client.post(
@@ -168,10 +162,8 @@ class BasicLearningFlowTests(TestCase):
         self.assertGreater(self.client.get('/api/user/summary').data['xp'], 0)
 
     def test_the_map_is_empty_but_healthy_before_a_grade_is_chosen(self):
-        response = self.client.post(
-            '/api/auth/session', {'type': 'guest', 'deviceId': 'flow-device-3'}, format='json',
-        )
-        self._auth(response.data['token'])
+        session = guest_session('flow-device-3')
+        self._auth(session['token'])
 
         home = self.client.get('/api/home')
         self.assertEqual(home.status_code, 200)