Fix "Log in as guest" on the login page

[tanhtm]

Problem

• The guest button used bg-secondary-600, which is not compiled into styles.css, so it had no background and read as plain text.
• The button showed even without a usable guest account. Clicking it then did nothing: GuestLoginView swallowed every error and bounced back to the login page with no message.

Changes

• Button: uses Unfold's secondary button, the same style as the other login buttons. The icon is aria-hidden. The button renders only when {% guest_login_available %} (new wn_guest tag) finds an active staff guest. Because the check lives in the template, it works on any admin site that renders admin/login.html.
• Shared helpers in base/utils.py, used by the view, AutoGuestLoginMiddleware and the tag:
  • get_guest_user(): logs DB errors and returns None, so it never breaks the login page.
  • log_in_guest() keeps the login in only one failure case: a read-only database (demo mode) refuses the last_login write after the session is already set (is_readonly_db_error). That is also how main2.0 behaves.
    • Any other DatabaseError is re-raised.
    • On failure, the previous session is restored in memory and not saved. A logged-in user whose switch fails (DB-backed sessions on a read-only DB) stays logged in, with no 500 from SessionMiddleware.
  • safe_next_url(): same host and same scheme, so there is no HTTPS→HTTP redirect.
• GuestLoginView:
  • login_not_required, so it works with Django's LoginRequiredMiddleware.
  • On failure it shows "Guest login is not available." (vi translation added) and returns to the login page with the original ?next.
  • Any logged-in user on the login page may switch to guest, staff included (they see the page after a failed password POST). Before, the button just bounced them back.
• AutoGuestLoginMiddleware:
  • Redirects to ?next as a URL. redirect() treated it as a route name, so ?next=foo raised NoReverseMatch.
  • Logs failures instead of except: pass.
• CSS:
  • styles.css is rebuilt; the old button's three utilities are gone.
  • Tailwind no longer scans its own output, which kept removed utilities' theme variables alive. Rebuilds were not reproducible, so the "Compiled CSS is up to date" check would have failed.

Testing

• GuestLoginButtonTests and AutoGuestLoginMiddlewareTests (13 tests). Each one was checked to fail without the change it covers.
• Full suite: 70 tests pass with SKIP_GUEST_LOGIN=True and with False. django check is clean. bash scripts/tailwind.sh twice in a row gives a byte-identical styles.css.
• The failed-switch case was also run with SESSION_ENGINE=db and a read-only session store:
  • Before the fix: 500.
  • After: 302 back to login, and the user is still logged in.
• Ran the app in Chromium:
  • The button is styled in light and dark themes and logs in as guest.
  • With the guest deactivated, the button is hidden, and a stale POST shows the error message.

Not changed

• AutoGuestLoginMiddleware is enabled when SKIP_GUEST_LOGIN=True. That is the opposite of what the name and docs/GUIDE.md say, but changing it would affect existing projects.
• The admin: URL namespace is hard-coded, as everywhere else in the package.

🤖 Generated with Claude Code

https://claude.ai/code/session_01YXGgGiATURgjVcvhP18qJ5