Add in-admin refund processing for Square token purchases; commit earlier pending security fixes

Refund feature: token_purchases had no way to refund a completed Square
payment - the existing resolve_purchase action only approves/rejects
manual (Zelle etc) payments still in pending status. Adds a real
refund_purchase action (api/admin.php) that calls Squares actual Refunds
API via a new SquarePayment::refund() method, updates status to the new
refunded enum value, logs the refund ID, and claws back the tokens
credited on purchase (clamped at 0 if the customer already spent some,
reported back as a shortfall so staff know). UI: admin/index.php shows a
Refund button on completed card purchases with a square_payment_id.

Tested in sandbox: full refund with full token clawback, and a shortfall
scenario (user already spent below the credited amount) to confirm
clamping works correctly rather than going negative.

Also committing two earlier pending fixes from this session that were
never committed: .htaccess .py/!install!! blocking hardening and moving
bump_version.PHPs BUMP_KEY out of the web-reachable file into
includes/config.php.

.htaccess

@@ -24,6 +24,13 @@ ServerSignature Off
     RewriteRule ^vendor/ - [F,L]
     RewriteRule ^mail_queue/ - [F,L]
     RewriteRule ^\.git/ - [F,L]
+
+    # Block sensitive file extensions anywhere in the tree — the
+    # <FilesMatch>/Order,Deny block above is not honored by this
+    # OpenLiteSpeed vhost (confirmed: db/schema.sql was still
+    # served 200 despite that rule), so enforce via RewriteRule,
+    # the mechanism proven to work here (.git/, vendor/ etc. above).
+    RewriteRule \.(sql|env|log|sh|bak|backup|old|orig|tmp|swp|cfg|ini|conf|yaml|yml)$ - [F,L]
 </IfModule>
 
 # ── Block common attack vectors ──────────────────────────