Fix stored XSS in admin gamer overview (unescaped username/alias/email) and undefined-variable logging bug in purchase.php

admin/index.php

@@ -1636,9 +1636,9 @@ function renderGamerOverview(u, stats) {
   const verified = parseInt(u.email_verified);
   document.getElementById('gm-info-grid').innerHTML = [
     { label: 'User ID',       val: '#' + u.id },
-    { label: 'Username',      val: u.username },
-    { label: 'Alias',         val: u.alias },
-    { label: 'Email',         val: u.email || '—' },
+    { label: 'Username',      val: escHtmlA(u.username) },
+    { label: 'Alias',         val: escHtmlA(u.alias) },
+    { label: 'Email',         val: u.email ? escHtmlA(u.email) : '—' },
     { label: 'Status',        val: `<span class="badge b-${u.status}">${u.status}</span>` },
     { label: 'Email Verified',val: verified ? '<span style="color:var(--green)">✓ Yes</span>' : '<span style="color:var(--yellow)">⚠ No</span>' },
     { label: 'Token Balance',  val: `<span style="color:var(--gold);font-family:\'Exo 2\',sans-serif;font-weight:700">${parseFloat(u.tokens||0)} 🪙</span>` },