fix: auth_login_api accepts email/account auto-detect, drop Turnstile

[JackyTJie]

Problem

Frontend Login.vue sends {email, password} to POST /api/auth/login/. Backend auth_login_api expects {account, password, turnstile_token}. Three mismatches:

Frontend sends	Backend expects
email	account
—	turnstile_token (required)
POST /api/accounts/login/	POST /api/auth/login/

Frontend URL is a separate issue (fixed via _redirects). This issue covers the request body contract.

Background

• Django User stores username = SJTU account name (e.g. zhangsan), email = {account}@sjtu.edu.cn
• Old Django template login.html labeled the input "Email" but field name was email — misleading. The value is really the account name, not a full email.
• turnstile_token adds bot protection but current frontend has no Turnstile widget. Small private site — acceptable to drop for now.

Proposed fix

In apps/auth/views.py:auth_login_api:

1. Accept email field (keep backward compat with account too)
2. Auto-detect: if value contains @, strip domain to get username; otherwise use as-is
3. Remove turnstile_token requirement (keep Turnstile in auth_initiate_api for OTP flow)
4. Look up by Django email field as fallback

Files to change

• apps/auth/views.py — auth_login_api function only (~30 lines)