fix: scope users API to end-users and tag new registrations as customers

- UserListView and UserMetricsView now filter is_superuser=False so only
  end-user accounts appear in the admin Users page (not admin/staff)
- _serialize_user now returns avatarUrl from profile_picture field so the
  grid view renders profile images instead of broken img tags
- RegisterForm and WebRegisterForm now set is_customer=True and
  role='customer' on save so future registrants are correctly classified

mobile_api/forms/user_forms.py

@@ -31,6 +31,9 @@ class RegisterForm(forms.ModelForm):
         # Set username equal to email to avoid separate username errors
         user.username = self.cleaned_data['email']
         user.set_password(self.cleaned_data['password'])
+        # Mark as a customer / end-user
+        user.is_customer = True
+        user.role = 'customer'
         if commit:
             user.save()
         return user
@@ -70,9 +73,9 @@ class WebRegisterForm(forms.ModelForm):
         # Set username equal to email to avoid separate username errors
         user.username = self.cleaned_data['email']
         user.set_password(self.cleaned_data['password'])
-        print('*' * 100)
-        print(user.username)
-        print('*' * 100)
+        # Mark as a customer / end-user
+        user.is_customer = True
+        user.role = 'customer'
         if commit:
             user.save()
         return user