Add Square payment processor, gated behind PAYMENT_PROCESSOR flag (default: stripe)

Consolidates payment processing onto the same Square account already used by
tomtomgames.com and parkerslingshotrentals.com. Collapses the two prior parallel
Stripe flows (hosted Checkout + embedded Elements) into a single Square Web
Payments SDK flow, since Payments API is synchronous and removes the original
reason for two paths.

- includes/square.php: squareApi() cURL helper (mirrors the pattern already
  used on parkerslingshotrentals.com), markSquarePaymentResult() as the single
  source of truth for order completion shared by the sync response, webhook,
  and reconciliation poll - fixes a pre-existing bug where loyalty points were
  only ever awarded from the polling endpoint, never from the webhook.
- api/create-square-payment.php replaces api/create-payment-intent.php;
  api/create-checkout-session.php deleted (no Square equivalent - single flow).
- api/webhook.php rewritten for Squares signature scheme and event types.
- api/payment-status.php repurposed to reconciliation-only fallback.
- payment.php branches on PAYMENT_PROCESSOR so Stripe and Square code coexist
  deployed while dormant - flipping one config constant is the cutover/rollback.
- admin/payments.php: added a Square settings card alongside the existing
  (now legacy-labeled) Stripe card.
- db/schema.sql + live DB: added square_payment_id/square_order_id columns,
  stripe_* columns kept for historical orders.

Not yet cut over - PAYMENT_PROCESSOR still defaults to stripe in
config-secrets.php (outside this repo). Sandbox testing still needed before
flipping to square/production.

db/schema.sql

@@ -326,6 +326,8 @@ CREATE TABLE `orders` (
   `order_status` enum('pending','confirmed','processing','shipped','delivered','cancelled','refunded') DEFAULT 'pending',
   `stripe_session_id` varchar(255) DEFAULT NULL,
   `stripe_payment_intent` varchar(255) DEFAULT NULL,
+  `square_payment_id` varchar(255) DEFAULT NULL,
+  `square_order_id` varchar(255) DEFAULT NULL,
   `tracking_number` varchar(100) DEFAULT NULL,
   `tracking_url` varchar(500) DEFAULT NULL,
   `notes` text DEFAULT NULL,