security: fix unauthenticated file upload/RCE risk, TLS bypass, XSS, and broken gift-card/review columns

- admin/api/upload-splash.php had NO admin-auth check (included the public
  customer header, not admin/includes/header.php) and both upload endpoints
  trusted the client-supplied MIME type and filename extension, so an
  attacker could name a file "shell.php", spoof Content-Type: image/png,
  and get PHP written into a web-reachable uploads/ directory. Added
  AdminAuth check and centralized real-content validation (getimagesize +
  server-side extension mapping) in a new handleImageUpload() helper used
  by both admin/upload-image.php and admin/api/upload-splash.php.
- Removed CURLOPT_SSL_VERIFYPEER => false from the CyberMail email calls
  in includes/email.php and includes/functions.php (MITM risk on the API
  key). Rewrote functions.php's sendEmail() as a thin wrapper around
  Email::send() so there's one implementation instead of two that could
  drift (this is what had the second copy of the TLS bypass).
- Escaped customer-controlled fields (customer_name, tracking info, reset
  URL) before interpolating into outbound HTML emails — name is free text
  from registration/checkout with no length/char restriction, so it was
  stored-HTML-injectable into every transactional email.
- Fixed api/redeem-gift-card.php referencing a nonexistent `balance` column
  on gift_cards (actual column is current_balance) — gift card redemption
  was completely broken, always returning "no remaining balance".
- Fixed api/submit-review.php inserting into nonexistent `content`/`status`
  columns on reviews (actual columns are `comment`/`is_approved`) — review
  submission was crashing on every request.
- Hardened .htaccess: block /db/*, /.git/*, and *.sql. Live site currently
  serves db/schema.sql and the full .git directory (including .git/config,
  which contains a GitHub PAT with push access) over HTTP — the existing
  config/includes RedirectMatch rules are also not being enforced live,
  see report for details; this needs a server-level fix too.
- Cleaned up README's leftover install instructions pointing at a deleted
  create-admin.php with a documented default password.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

api/redeem-gift-card.php

@@ -35,7 +35,7 @@ if (!$giftCard) {
     jsonResponse(['error' => 'Gift card not found or already used'], 404);
 }
 
-if ($giftCard['balance'] <= 0) {
+if ($giftCard['current_balance'] <= 0) {
     jsonResponse(['error' => 'This gift card has no remaining balance'], 400);
 }
 
@@ -43,15 +43,15 @@ if ($giftCard['expires_at'] && strtotime($giftCard['expires_at']) < time()) {
     jsonResponse(['error' => 'This gift card has expired'], 400);
 }
 
-$amount = $giftCard['balance'];
+$amount = $giftCard['current_balance'];
 
 try {
     // Start transaction
     db()->query("START TRANSACTION");
-    
+
     // Update gift card balance to 0
     db()->query(
-        "UPDATE gift_cards SET balance = 0, is_active = 0, updated_at = NOW() WHERE gift_card_id = :id",
+        "UPDATE gift_cards SET current_balance = 0, is_active = 0, updated_at = NOW() WHERE gift_card_id = :id",
         ['id' => $giftCard['gift_card_id']]
     );
     

api/submit-review.php

@@ -55,8 +55,8 @@ db()->insert('reviews', [
     'customer_email' => $customer['email'],
     'rating' => $rating,
     'title' => $title,
-    'content' => $content,
-    'status' => 'pending' // Reviews require admin approval
+    'comment' => $content,
+    'is_approved' => 0 // Reviews require admin approval
 ]);
 
 jsonResponse([