Add in-admin refund processing for Square token purchases; commit earlier pending security fixes

Refund feature: token_purchases had no way to refund a completed Square
payment - the existing resolve_purchase action only approves/rejects
manual (Zelle etc) payments still in pending status. Adds a real
refund_purchase action (api/admin.php) that calls Squares actual Refunds
API via a new SquarePayment::refund() method, updates status to the new
refunded enum value, logs the refund ID, and claws back the tokens
credited on purchase (clamped at 0 if the customer already spent some,
reported back as a shortfall so staff know). UI: admin/index.php shows a
Refund button on completed card purchases with a square_payment_id.

Tested in sandbox: full refund with full token clawback, and a shortfall
scenario (user already spent below the credited amount) to confirm
clamping works correctly rather than going negative.

Also committing two earlier pending fixes from this session that were
never committed: .htaccess .py/!install!! blocking hardening and moving
bump_version.PHPs BUMP_KEY out of the web-reachable file into
includes/config.php.

bump_version.php

@@ -9,7 +9,7 @@
  *               ?key=ADMIN_KEY&bump=major  (1.0.1 → 2.0.0)
  */
 
-define('BUMP_KEY', 'TTG_bump_2026!'); // Change this to your own secret key
+require_once __DIR__ . '/../includes/config.php'; // BUMP_KEY now defined there, not in this web-reachable file
 
 if (($_GET['key'] ?? '') !== BUMP_KEY) {
     http_response_code(403);