Unguessable slugs; accept slug or PK on detail API

[skaphan]

Summary

• _get_unique_slug() now appends 12 random hex chars (secrets.token_hex(6)) instead of an incrementing -N counter. Slugs stay title-prefixed (good for SEO and admin browsing) but become non-enumerable.
• JsonOnlyViewSet, VerboseViewSet, and BallotpediaViewSet accept either the integer PK or the slug as the detail URL's lookup value, via a small PkOrSlugLookupMixin. No URL routing changes.

Motivation

1. Slug enumeration. Anyone who can guess or discover a title can walk the counter space (/v/<title>, /v/<title>-1, /v/<title>-2, ...) to browse other visualizations the instance has stored. Random suffixes close this off.
2. Cross-client PATCH overwrite on ephemeral deployments. Integer PKs are reused after a database reset (e.g. Cloud Run with an ephemeral DB). A stale PATCH from one client can silently overwrite a different client's freshly-created record that happened to land on the same PK. Addressing records by slug (the new unguessable form) eliminates the collision vector because 48 bits of randomness cannot recur after a reset.

Backward compatibility

• No schema change, no data migration. Old records keep their counter-style slugs and remain valid. Only newly-created records get the random suffix.
• Existing integer-PK clients keep working. PkOrSlugLookupMixin.get_object() dispatches digit-only lookup values as PKs (falling back to slug if not found), and non-digit values as slugs. Clients can opt into slug-based addressing at their own pace.
• The existing uniqueness loop is retained as belt-and-suspenders for the astronomically-rare 48-bit collision.

Tests

• Updated existing tests that asserted the old -N format to assert the new -<12-hex> format (regex).
• New test_detail_accepts_pk_and_slug exercises the dual-lookup mixin: both /api/visualizations/<pk>/ and /api/visualizations/<slug>/ resolve to the same record.

Test plan

• ./scripts/run-tests.sh passes
• Upload a new visualization; confirm URL uses the random-suffix slug
• curl /api/visualizations/<pk>/ and curl /api/visualizations/<slug>/ both return the same record
• Existing records with counter-style slugs remain reachable