Add drag-to-pan + zoom photo repositioning for card/avatar crops

Every photo upload (session setup, novena group, Rosary Builder title
photo) gets shown two ways: full-size on the presentation cover slide
(unaffected, stays untouched), and cropped to a fixed box everywhere else
— home page cards, profile cards, the novena day-picker's circular hero
photo, and each admin form's own preview thumbnail. All of those crops
used to just take the image's dead center, with no way to control what
part of the photo that was — cropping out people's heads on portrait
photos.

- New sessions/novena_groups columns: photo_focal_x, photo_focal_y (0-100%),
  photo_zoom (1-3x), defaulting to 50/50/1 — today's exact centered/
  unzoomed behavior, so this is fully backward compatible until someone
  actively repositions a photo.

- New assets/js/photo-crop.js: a reusable drag-to-pan + zoom modal editor.
  The crop frame renders with the *exact* CSS recipe used at final render
  time (object-position + transform:scale/transform-origin), so the editor
  is a truthful live preview, not an approximation. A reference thumbnail
  shows the full photo dimmed outside a rectangle marking the current crop.
  All math reads actual rendered box dimensions rather than assuming fixed
  pixel sizes, so it holds up responsively at any viewport width — caught
  and fixed a real mismatch bug here by testing the widget standalone in a
  browser before wiring it into any PHP form.

- New includes/photo.php: photo_crop_style() builds the inline style="..."
  from a session/group row, used everywhere a crop is displayed.

- Wired into all three upload locations (admin/setup.php,
  admin/novena_group.php, admin/builder.php) with a "Reposition" button,
  and persisted through api/save_session.php, admin/novena_group.php's
  save handler, and api/builder_session.php.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

admin/setup.php

@@ -5,6 +5,7 @@
 require_once __DIR__ . '/../config/db.php';
 require_once __DIR__ . '/../includes/auth.php';
 require_once __DIR__ . '/../includes/csrf.php';
+require_once __DIR__ . '/../includes/photo.php';
 
 require_auth();
 
@@ -47,6 +48,7 @@ $page_title = $session ? 'Edit Session' : 'New Session';
     <link rel="icon" type="image/svg+xml" href="<?= BASE_URL ?>/favicon.svg">
     <title><?= $page_title ?> — <?= htmlspecialchars($site_name) ?></title>
     <link rel="stylesheet" href="<?= BASE_URL ?>/assets/css/setup.css">
+    <link rel="stylesheet" href="<?= BASE_URL ?>/assets/css/photo-crop.css">
     <meta name="csrf-token" content="<?= htmlspecialchars(csrf_token()) ?>">
     <script>var BASE_URL = '<?= BASE_URL ?>';</script>
 </head>
@@ -213,17 +215,22 @@ $page_title = $session ? 'Edit Session' : 'New Session';
                 <!-- Photo -->
                 <div class="form-group" id="field-photo">
                     <label for="photo">Photo (optional)</label>
-                    <?php if (!empty($session['photo_path'])): ?>
-                        <div class="photo-preview">
-                            <img src="<?= htmlspecialchars('/' . ltrim($session['photo_path'], '/')) ?>"
-                                 alt="Current photo" style="max-height:120px">
-                            <p class="help-text">Current photo. Upload a new one to replace it.</p>
-                        </div>
-                    <?php endif; ?>
+                    <div class="photo-preview-wrap" style="<?= empty($session['photo_path']) ? 'display:none' : '' ?>">
+                        <img id="photo-preview"
+                             src="<?= !empty($session['photo_path']) ? htmlspecialchars('/' . ltrim($session['photo_path'], '/')) : '' ?>"
+                             alt="Current photo" class="photo-preview"
+                             style="<?= !empty($session['photo_path']) ? htmlspecialchars(photo_crop_style($session)) : '' ?>">
+                    </div>
                     <input type="file" id="photo" name="photo" accept="image/*">
                     <p class="help-text">JPEG, PNG, WebP — max 5 MB. Recommended: square or landscape, at least 800 × 600 px. Shown on the home page card and cover slide.</p>
                     <input type="hidden" id="photo_path" name="photo_path"
                            value="<?= htmlspecialchars($session['photo_path'] ?? '') ?>">
+                    <input type="hidden" id="photo_focal_x" name="photo_focal_x" value="<?= htmlspecialchars($session['photo_focal_x'] ?? 50) ?>">
+                    <input type="hidden" id="photo_focal_y" name="photo_focal_y" value="<?= htmlspecialchars($session['photo_focal_y'] ?? 50) ?>">
+                    <input type="hidden" id="photo_zoom" name="photo_zoom" value="<?= htmlspecialchars($session['photo_zoom'] ?? 1) ?>">
+                    <button type="button" id="photo-reposition" class="btn btn-secondary" style="margin-top:8px;<?= empty($session['photo_path']) ? 'display:none' : '' ?>">
+                        Reposition
+                    </button>
                     <div id="upload-status" style="display:none" class="upload-status"></div>
                 </div>
 
@@ -252,6 +259,7 @@ $page_title = $session ? 'Edit Session' : 'New Session';
         </main>
     </div>
 
+    <script src="<?= BASE_URL ?>/assets/js/photo-crop.js"></script>
     <script src="<?= BASE_URL ?>/assets/js/setup.js?v=5"></script>
 </body>
 </html>