security: fix unauthenticated file upload/RCE risk, TLS bypass, XSS, and broken gift-card/review columns

- admin/api/upload-splash.php had NO admin-auth check (included the public
  customer header, not admin/includes/header.php) and both upload endpoints
  trusted the client-supplied MIME type and filename extension, so an
  attacker could name a file "shell.php", spoof Content-Type: image/png,
  and get PHP written into a web-reachable uploads/ directory. Added
  AdminAuth check and centralized real-content validation (getimagesize +
  server-side extension mapping) in a new handleImageUpload() helper used
  by both admin/upload-image.php and admin/api/upload-splash.php.
- Removed CURLOPT_SSL_VERIFYPEER => false from the CyberMail email calls
  in includes/email.php and includes/functions.php (MITM risk on the API
  key). Rewrote functions.php's sendEmail() as a thin wrapper around
  Email::send() so there's one implementation instead of two that could
  drift (this is what had the second copy of the TLS bypass).
- Escaped customer-controlled fields (customer_name, tracking info, reset
  URL) before interpolating into outbound HTML emails — name is free text
  from registration/checkout with no length/char restriction, so it was
  stored-HTML-injectable into every transactional email.
- Fixed api/redeem-gift-card.php referencing a nonexistent `balance` column
  on gift_cards (actual column is current_balance) — gift card redemption
  was completely broken, always returning "no remaining balance".
- Fixed api/submit-review.php inserting into nonexistent `content`/`status`
  columns on reviews (actual columns are `comment`/`is_approved`) — review
  submission was crashing on every request.
- Hardened .htaccess: block /db/*, /.git/*, and *.sql. Live site currently
  serves db/schema.sql and the full .git directory (including .git/config,
  which contains a GitHub PAT with push access) over HTTP — the existing
  config/includes RedirectMatch rules are also not being enforced live,
  see report for details; this needs a server-level fix too.
- Cleaned up README's leftover install instructions pointing at a deleted
  create-admin.php with a documented default password.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

includes/email.php

@@ -75,7 +75,7 @@ class Email {
             CURLOPT_HTTPHEADER     => ['Authorization: Bearer ' . $this->apiKey, 'Content-Type: application/json'],
             CURLOPT_RETURNTRANSFER => true,
             CURLOPT_TIMEOUT        => 30,
-            CURLOPT_SSL_VERIFYPEER => false,
+            CURLOPT_SSL_VERIFYPEER => true,
         ]);
         $response = curl_exec($ch);
         $httpCode = curl_getinfo($ch, CURLINFO_HTTP_CODE);
@@ -115,8 +115,8 @@ class Email {
             );
         }
         $html = $this->getTemplate('order_confirmation', [
-            'order_number'   => $order['order_number'],
-            'customer_name'  => $order['customer_name'] ?? 'Valued Customer',
+            'order_number'   => htmlspecialchars($order['order_number']),
+            'customer_name'  => htmlspecialchars($order['customer_name'] ?? 'Valued Customer'),
             'items_html'     => $itemsHtml,
             'subtotal'       => formatCurrency($order['subtotal']),
             'tax'            => formatCurrency($order['tax']),
@@ -136,11 +136,11 @@ class Email {
 
     public function sendShippingNotification(array $order): array {
         $html = $this->getTemplate('shipping_notification', [
-            'order_number'    => $order['order_number'],
-            'customer_name'   => $order['customer_name'] ?? 'Valued Customer',
-            'tracking_number' => $order['tracking_number'],
-            'tracking_url'    => $order['tracking_url'] ?? '#',
-            'carrier'         => $order['shipping_carrier'] ?? 'Our shipping partner'
+            'order_number'    => htmlspecialchars($order['order_number']),
+            'customer_name'   => htmlspecialchars($order['customer_name'] ?? 'Valued Customer'),
+            'tracking_number' => htmlspecialchars($order['tracking_number']),
+            'tracking_url'    => htmlspecialchars($order['tracking_url'] ?? '#'),
+            'carrier'         => htmlspecialchars($order['shipping_carrier'] ?? 'Our shipping partner')
         ]);
         return $this->send(
             $order['customer_email'],
@@ -154,8 +154,8 @@ class Email {
     public function sendPasswordReset(string $email, string $resetToken, string $name = ''): array {
         $resetUrl = SITE_URL . '/reset-password.php?token=' . $resetToken;
         $html = $this->getTemplate('password_reset', [
-            'customer_name' => $name ?: 'there',
-            'reset_url'     => $resetUrl,
+            'customer_name' => htmlspecialchars($name ?: 'there'),
+            'reset_url'     => htmlspecialchars($resetUrl),
             'expires'       => '1 hour'
         ]);
         return $this->send($email, "Reset Your Password - Tom's Java Jive", $html, null, ['tags' => ['password-reset']]);
@@ -163,7 +163,7 @@ class Email {
 
     public function sendWelcome(string $email, string $name = ''): array {
         $html = $this->getTemplate('welcome', [
-            'customer_name' => $name ?: 'Coffee Lover',
+            'customer_name' => htmlspecialchars($name ?: 'Coffee Lover'),
             'shop_url'      => SITE_URL . '/shop.php'
         ]);
         return $this->send($email, "Welcome to Tom's Java Jive!", $html, null, ['tags' => ['welcome']]);