Fix permissions and prepare admin login for deploy

- Admin-only: list contacts, create/edit campaigns and compositions
- Public: submit contact, mine contacts by email/phone, read campaigns/compositions
- Add admin_response field on ContactUs
- Update Postman base_url to https://zoneco.org/api with token save

Co-authored-by: Cursor <cursoragent@cursor.com>

api/migrations/0003_contact_admin_response.py

@@ -0,0 +1,22 @@
+# Generated by Django 4.2.7 on 2026-07-22 19:20
+
+from django.db import migrations, models
+
+
+class Migration(migrations.Migration):
+
+    dependencies = [
+        ('api', '0002_composition_images'),
+    ]
+
+    operations = [
+        migrations.AddField(
+            model_name='contactus',
+            name='admin_response',
+            field=models.TextField(blank=True, default='', help_text='Admin reply visible to the contact submitter', verbose_name='پاسخ ادمین'),
+        ),
+        migrations.AddIndex(
+            model_name='contactus',
+            index=models.Index(fields=['email_or_phone'], name='api_contact_email_o_fedc42_idx'),
+        ),
+    ]