refactor(cleanup): remove dead GuestUser/GuestInvitation code and fix test imports

Deleted:
- app/models/guest_user.py
- app/models/guest_invitation.py
- app/routes/guest_auth.py (was orphaned, not imported)
- tests/test_guest_auth.py (tested removed guest auth system)

Modified:
- app/models/__init__.py: removed stale GuestUser/GuestInvitation comments
- app/services/entity_permission_service.py: updated guest permission comment
- tests/test_permission_system_live.py: replaced GuestUser with User+UserTenant(role=guest),
  changed principal_type from "guest" to "user", switched guest test from
  /api/v1/guest/login to regular /api/v1/auth/login endpoint

Frontend: no guest components found, nothing to clean up.
Alembic migrations: historical migrations referencing guest_users/guest_invitations
  tables are left intact (they document DB history).

tests/test_permission_system_live.py

@@ -47,7 +47,6 @@ from app.models.role import Role
 from app.models.tenant import Tenant
 from app.models.user import User, UserTenant
 from app.models.entity_permission import EntityPermission
-from app.models.guest_user import GuestUser
 from app.models.group import Group, UserGroup
 from app.plugins.registry import reset_registry_for_testing  # noqa: F401
 from app.services.plugin_service import reset_plugin_service_for_testing  # noqa: F401
@@ -262,13 +261,13 @@ async def seed_full_data(db: AsyncSession) -> dict[str, Any]:
         is_active=True,
         preferences={},
     )
-    # Guest user in tenant A
-    guest_a = GuestUser(
+    # Guest user in tenant A (now a regular User with role=guest)
+    guest_a = User(
         email="guest@tenanta.com",
         name="Guest A",
         password_hash=hash_password("TestPass123!"),
-        tenant_id=tenant_a.id,
-        status="active",
+        is_active=True,
+        preferences={},
     )
     db.add_all([admin_a, editor_a, viewer_a, admin_b, orphan_user, guest_a])
     await db.flush()
@@ -280,7 +279,9 @@ async def seed_full_data(db: AsyncSession) -> dict[str, Any]:
     ut4 = UserTenant(user_id=admin_b.id, tenant_id=tenant_b.id, is_default=True, role="admin")
     # Admin A is also member of tenant B (multi-tenant)
     ut5 = UserTenant(user_id=admin_a.id, tenant_id=tenant_b.id, is_default=False, role="admin")
-    db.add_all([ut1, ut2, ut3, ut4, ut5])
+    # Guest tenant membership with role=guest
+    ut6 = UserTenant(user_id=guest_a.id, tenant_id=tenant_a.id, is_default=True, role="guest")
+    db.add_all([ut1, ut2, ut3, ut4, ut5, ut6])
     await db.flush()
 
     # Custom role with limited permissions in tenant A
@@ -368,7 +369,7 @@ async def seed_full_data(db: AsyncSession) -> dict[str, Any]:
         tenant_id=tenant_a.id,
         entity_type="contact",
         entity_id=contact_a1.id,
-        principal_type="guest",
+        principal_type="user",
         principal_id=guest_a.id,
         permission_level="read",
         created_by=admin_a.id,
@@ -862,26 +863,12 @@ async def test_scenario_guest_access(client: AsyncClient, db_session: AsyncSessi
     """Guest user can only see entities shared with them."""
     seed = await seed_full_data(db_session)
 
-    # Guest login
-    resp = await client.post(
-        "/api/v1/guest/login",
-        json={
-            "email": "guest@tenanta.com",
-            "password": "TestPass123!",
-            "tenant_slug": "tenant-a",
-        },
-        headers=ORIGIN_HEADER,
-    )
-    assert resp.status_code == 200, f"Guest login failed: {resp.status_code} {resp.text}"
+    # Guest login (now uses regular auth endpoint)
+    await login(client, "guest@tenanta.com", tenant_slug="tenant-a")
 
     # Guest should be able to access shared contact (contact_a1 shared with guest)
-    # Note: guest endpoints may differ from regular contact endpoints
-    # Test guest-specific contact access if available
-    # If no guest contact endpoint exists, verify guest session is valid
-    guest_session = resp.json()
-    assert guest_session.get("guest_user_id") or guest_session.get("user_id"), (
-        f"Guest session should have user ID: {guest_session}"
-    )
+    resp = await client.get("/api/v1/contacts")
+    assert resp.status_code == 200, f"Guest contacts access failed: {resp.status_code} {resp.text}"
 
 
 @pytest.mark.asyncio