Fix permissions and prepare admin login for deploy

- Admin-only: list contacts, create/edit campaigns and compositions
- Public: submit contact, mine contacts by email/phone, read campaigns/compositions
- Add admin_response field on ContactUs
- Update Postman base_url to https://zoneco.org/api with token save

Co-authored-by: Cursor <cursoragent@cursor.com>

README.md

@@ -91,10 +91,12 @@ On Docker deploy, `entrypoint.sh` creates/updates the admin from `ADMIN_USERNAME
 ### Login
 
 ```
-POST {{base_url}}/api/admin/login/
+POST {{base_url}}/admin/login/
 Content-Type: application/json
 ```
 
+> In Postman, set `base_url` to `https://zoneco.org/api` (includes `/api`).
+
 ```json
 {
   "username": "{{admin_username}}",
@@ -102,7 +104,7 @@ Content-Type: application/json
 }
 ```
 
-**Response:**
+**Response includes the admin token:**
 ```json
 {
   "token": "<token>",
@@ -124,14 +126,14 @@ Authorization: Token <your_token_here>
 ### Current admin user
 
 ```
-GET {{base_url}}/api/admin/me/
+GET {{base_url}}/admin/me/
 Authorization: Token <token>
 ```
 
 ### Logout (deletes the token)
 
 ```
-POST {{base_url}}/api/admin/logout/
+POST {{base_url}}/admin/logout/
 Authorization: Token <token>
 ```
 
@@ -139,13 +141,21 @@ Authorization: Token <token>
 
 ## API Endpoints
 
-### Authentication
+### Authentication / Permissions
+
+| Who | Allowed |
+|-----|---------|
+| Public (user) | Submit contact, view own contacts (`/contact-us/mine/`), view campaigns & compositions (مقالات) |
+| Admin only | List all contacts, reply to contacts, create/edit/delete campaigns & compositions |
 
 | Action | Access |
 |--------|--------|
-| GET (list, retrieve, custom filters) | Public — no login required |
-| POST (create) | Public — no login required |
-| PUT / PATCH / DELETE | Admin only — Token required |
+| GET list/retrieve campaigns & compositions | Public |
+| POST create campaigns & compositions | Admin — Token required |
+| PUT / PATCH / DELETE | Admin — Token required |
+| Contact create | Public |
+| Contact list / by_category / reply | Admin — Token required |
+| Contact mine (`?email_or_phone=`) | Public |
 | Admin login / logout / me | See Admin Login API above |
 
 ---