Add Square payment processor, gated behind PAYMENT_PROCESSOR flag (default: stripe)

Consolidates payment processing onto the same Square account already used by
tomtomgames.com and parkerslingshotrentals.com. Collapses the two prior parallel
Stripe flows (hosted Checkout + embedded Elements) into a single Square Web
Payments SDK flow, since Payments API is synchronous and removes the original
reason for two paths.

- includes/square.php: squareApi() cURL helper (mirrors the pattern already
  used on parkerslingshotrentals.com), markSquarePaymentResult() as the single
  source of truth for order completion shared by the sync response, webhook,
  and reconciliation poll - fixes a pre-existing bug where loyalty points were
  only ever awarded from the polling endpoint, never from the webhook.
- api/create-square-payment.php replaces api/create-payment-intent.php;
  api/create-checkout-session.php deleted (no Square equivalent - single flow).
- api/webhook.php rewritten for Squares signature scheme and event types.
- api/payment-status.php repurposed to reconciliation-only fallback.
- payment.php branches on PAYMENT_PROCESSOR so Stripe and Square code coexist
  deployed while dormant - flipping one config constant is the cutover/rollback.
- admin/payments.php: added a Square settings card alongside the existing
  (now legacy-labeled) Stripe card.
- db/schema.sql + live DB: added square_payment_id/square_order_id columns,
  stripe_* columns kept for historical orders.

Not yet cut over - PAYMENT_PROCESSOR still defaults to stripe in
config-secrets.php (outside this repo). Sandbox testing still needed before
flipping to square/production.

api/create-square-payment.php

@@ -0,0 +1,94 @@
+<?php
+/**
+ * Tom's Java Jive - Create Square Payment API
+ * Accepts a Web Payments SDK card nonce (source_id) and charges it synchronously.
+ */
+
+require_once __DIR__ . '/../includes/functions.php';
+require_once __DIR__ . '/../includes/square.php';
+require_once __DIR__ . '/../includes/loyalty.php';
+require_once __DIR__ . '/../includes/email.php';
+
+header('Content-Type: application/json');
+
+if ($_SERVER['REQUEST_METHOD'] !== 'POST') {
+    jsonResponse(['error' => 'Method not allowed'], 405);
+}
+
+$input     = json_decode(file_get_contents('php://input'), true);
+$orderId   = $input['order_id'] ?? '';
+$sourceId  = $input['source_id'] ?? '';
+
+if (empty($orderId)) {
+    jsonResponse(['error' => 'Order ID required'], 400);
+}
+
+$order = db()->fetch(
+    "SELECT * FROM orders WHERE order_id = :id",
+    ['id' => $orderId]
+);
+
+if (!$order) {
+    jsonResponse(['error' => 'Order not found'], 404);
+}
+
+if ($order['payment_status'] === 'paid') {
+    jsonResponse(['error' => 'Order already paid'], 400);
+}
+
+// Demo mode - Square not configured
+if (!isSquareConfigured()) {
+    db()->update('orders',
+        [
+            'payment_status'    => 'paid',
+            'order_status'      => 'confirmed',
+            'square_payment_id' => 'demo_' . bin2hex(random_bytes(8)),
+            'payment_method'    => 'square',
+        ],
+        'order_id = :id',
+        ['id' => $orderId]
+    );
+
+    jsonResponse([
+        'demo_mode' => true,
+        'message'   => 'Payment simulated (Square not configured)',
+        'redirect'  => '/order-confirmation.php?order=' . $orderId
+    ]);
+}
+
+if (empty($sourceId)) {
+    jsonResponse(['error' => 'Card details required'], 400);
+}
+
+try {
+    $result  = squareCreatePayment(
+        $sourceId,
+        (float) $order['total'],
+        $orderId,
+        ['note' => 'Order #' . $order['order_number']]
+    );
+    $payment = $result['payment'] ?? [];
+    $status  = $payment['status'] ?? '';
+
+    if ($status === 'COMPLETED') {
+        markSquarePaymentResult($payment['id'], $orderId, 'COMPLETED');
+        jsonResponse([
+            'success'  => true,
+            'redirect' => '/order-confirmation.php?order=' . $orderId
+        ]);
+    }
+
+    // Store the payment id even if not yet completed, so the reconciliation
+    // poll and webhook can find this order by square_payment_id.
+    db()->update('orders',
+        ['square_payment_id' => $payment['id'] ?? null],
+        'order_id = :id',
+        ['id' => $orderId]
+    );
+
+    jsonResponse(['error' => 'Payment was not completed (status: ' . $status . ')'], 400);
+
+} catch (Exception $e) {
+    error_log('Square payment error: ' . $e->getMessage());
+    jsonResponse(['error' => 'Payment failed: ' . $e->getMessage()], 500);
+}