Fix permissions and prepare admin login for deploy

- Admin-only: list contacts, create/edit campaigns and compositions
- Public: submit contact, mine contacts by email/phone, read campaigns/compositions
- Add admin_response field on ContactUs
- Update Postman base_url to https://zoneco.org/api with token save

Co-authored-by: Cursor <cursoragent@cursor.com>

api/serializers.py

@@ -32,11 +32,14 @@ class AdminLoginSerializer(serializers.Serializer):
 class ContactUsSerializer(serializers.ModelSerializer):
     """
     Serializer for ContactUs model.
+    Public create cannot set admin_response (enforced in the viewset).
     """
     class Meta:
         model = ContactUs
-        fields = ['id', 'name', 'email_or_phone', 'description', 'category', 
-                  'created_at', 'updated_at']
+        fields = [
+            'id', 'name', 'email_or_phone', 'description', 'category',
+            'admin_response', 'created_at', 'updated_at',
+        ]
         read_only_fields = ['id', 'created_at', 'updated_at']
     
     def validate_email_or_phone(self, value):