Add wishlist feature and admin/analytics endpoints

Introduces a Wishlist model with related serializers, admin, and API endpoints for users to manage favorite products. Adds admin endpoints for wishlist management and a placeholder AnalyticsViewSet for future business intelligence features. Refactors permissions for commerce views, updates product filtering and ordering, and improves carrier and payment logic. Also includes minor VSCode settings and Zasilkovna client import updates.

backend/account/permissions.py

@@ -55,3 +55,23 @@ class AdminOnly(BasePermission):
     def has_permission(self, request, view):
         return request.user and request.user.is_authenticated and getattr(request.user, 'role', None) == 'admin'
 
+
+# Commerce-specific permissions
+class AdminWriteOnlyOrReadOnly(BasePermission):
+    """Allow read for anyone, write only for admins"""
+    def has_permission(self, request, view):
+        if request.method in SAFE_METHODS:
+            return True
+        return request.user and request.user.is_authenticated and getattr(request.user, 'role', None) == 'admin'
+
+
+class AdminOnlyForPatchOtherwisePublic(BasePermission):
+    """Allow GET/POST for anyone, PATCH/PUT/DELETE only for admins"""
+    def has_permission(self, request, view):
+        if request.method in SAFE_METHODS or request.method == "POST":
+            return True
+        if request.method in ["PATCH", "PUT", "DELETE"]:
+            return request.user and request.user.is_authenticated and getattr(request.user, 'role', None) == 'admin'
+        # Default to admin for other unsafe methods
+        return request.user and request.user.is_authenticated and getattr(request.user, 'role', None) == 'admin'
+