fix: scope users API to end-users and tag new registrations as customers

- UserListView and UserMetricsView now filter is_superuser=False so only
  end-user accounts appear in the admin Users page (not admin/staff)
- _serialize_user now returns avatarUrl from profile_picture field so the
  grid view renders profile images instead of broken img tags
- RegisterForm and WebRegisterForm now set is_customer=True and
  role='customer' on save so future registrants are correctly classified

admin_api/views.py

@@ -491,12 +491,18 @@ _USER_ROLE_MAP = {
 def _serialize_user(u):
     full_name = f'{u.first_name} {u.last_name}'.strip() or u.username
     role_key = u.role if u.role else ('customer' if getattr(u, 'is_customer', False) else 'staff')
+    try:
+        pic = u.profile_picture
+        avatar = pic.url if pic and pic.name and pic.name != 'default.png' else ''
+    except Exception:
+        avatar = ''
     return {
         'id': str(u.id),
         'name': full_name,
         'email': u.email,
         'phone': getattr(u, 'phone_number', '') or '',
         'countryCode': '+91',
+        'avatarUrl': avatar,
         'role': _USER_ROLE_MAP.get(role_key, 'User'),
         'status': _user_status(u),
         'tier': 'Bronze',
@@ -527,16 +533,19 @@ class UserMetricsView(APIView):
 
     def get(self, request):
         from django.contrib.auth import get_user_model
+        from django.db.models import Q
         from django.utils import timezone
         import datetime
         User = get_user_model()
         today = timezone.now().date()
         week_ago = today - datetime.timedelta(days=7)
+        # Customers = all non-superuser accounts (end users registered via mobile/web)
+        customer_qs = User.objects.filter(is_superuser=False)
         return Response({
-            'total':       User.objects.count(),
-            'active':      User.objects.filter(is_active=True).count(),
-            'suspended':   User.objects.filter(is_active=False).count(),
-            'newThisWeek': User.objects.filter(date_joined__date__gte=week_ago).count(),
+            'total':       customer_qs.count(),
+            'active':      customer_qs.filter(is_active=True).count(),
+            'suspended':   customer_qs.filter(is_active=False).count(),
+            'newThisWeek': customer_qs.filter(date_joined__date__gte=week_ago).count(),
         })
 
 
@@ -547,7 +556,8 @@ class UserListView(APIView):
         from django.contrib.auth import get_user_model
         from django.db.models import Q
         User = get_user_model()
-        qs = User.objects.all()
+        # Customers = all non-superuser accounts (end users registered via mobile/web)
+        qs = User.objects.filter(is_superuser=False)
         if s := request.GET.get('status'):
             if s == 'Active':
                 qs = qs.filter(is_active=True)