Add in-admin refund processing via Square RefundPayment API

admin/order.php previously had no real refund action - the "refunded"
status option was purely cosmetic, only setting order_status without
touching payment_status or calling any payment API. Adds a Refund card
(full or partial amount, optional reason) that calls the real Square
Refunds API for orders paid via Square, updates payment_status
(refunded/partially_refunded) and order_status, logs the refund ID as an
order note, and restores any wallet_amount_used back to the customer
wallet on a full refund (mirroring how it was deducted on payment
success in markSquarePaymentResult). Also fixed the Payment sidebar card
to display square_payment_id (it only ever showed the old stripe_payment_intent
field, even for Square orders).

Tested in sandbox: full refund (wallet restore verified), and confirmed
Squares own over-refund rejection surfaces cleanly as a flash error
rather than a crash.

includes/square.php

@@ -73,6 +73,21 @@ function squareGetPayment(string $paymentId): array {
     return squareApi('GET', '/payments/' . $paymentId);
 }
 
+function squareRefundPayment(string $paymentId, float $amount, string $reason = ''): array {
+    $body = [
+        'idempotency_key' => 'refund_' . $paymentId . '_' . bin2hex(random_bytes(6)),
+        'amount_money'    => [
+            'amount'   => (int) round($amount * 100),
+            'currency' => 'USD',
+        ],
+        'payment_id' => $paymentId,
+    ];
+    if ($reason) {
+        $body['reason'] = substr($reason, 0, 192);
+    }
+    return squareApi('POST', '/refunds', $body);
+}
+
 function isSquareConfigured(): bool {
     return defined('SQUARE_ACCESS_TOKEN') && defined('SQUARE_APP_ID') && defined('SQUARE_LOCATION_ID')
         && !empty(SQUARE_ACCESS_TOKEN) && !empty(SQUARE_APP_ID) && !empty(SQUARE_LOCATION_ID)