Add drag-to-pan + zoom photo repositioning for card/avatar crops

Every photo upload (session setup, novena group, Rosary Builder title
photo) gets shown two ways: full-size on the presentation cover slide
(unaffected, stays untouched), and cropped to a fixed box everywhere else
— home page cards, profile cards, the novena day-picker's circular hero
photo, and each admin form's own preview thumbnail. All of those crops
used to just take the image's dead center, with no way to control what
part of the photo that was — cropping out people's heads on portrait
photos.

- New sessions/novena_groups columns: photo_focal_x, photo_focal_y (0-100%),
  photo_zoom (1-3x), defaulting to 50/50/1 — today's exact centered/
  unzoomed behavior, so this is fully backward compatible until someone
  actively repositions a photo.

- New assets/js/photo-crop.js: a reusable drag-to-pan + zoom modal editor.
  The crop frame renders with the *exact* CSS recipe used at final render
  time (object-position + transform:scale/transform-origin), so the editor
  is a truthful live preview, not an approximation. A reference thumbnail
  shows the full photo dimmed outside a rectangle marking the current crop.
  All math reads actual rendered box dimensions rather than assuming fixed
  pixel sizes, so it holds up responsively at any viewport width — caught
  and fixed a real mismatch bug here by testing the widget standalone in a
  browser before wiring it into any PHP form.

- New includes/photo.php: photo_crop_style() builds the inline style="..."
  from a session/group row, used everywhere a crop is displayed.

- Wired into all three upload locations (admin/setup.php,
  admin/novena_group.php, admin/builder.php) with a "Reposition" button,
  and persisted through api/save_session.php, admin/novena_group.php's
  save handler, and api/builder_session.php.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

profile.php

@@ -5,6 +5,7 @@
  */
 require_once __DIR__ . '/config/db.php';
 require_once __DIR__ . '/includes/auth.php';
+require_once __DIR__ . '/includes/photo.php';
 
 _auth_start();
 $pdo       = get_pdo();
@@ -35,7 +36,8 @@ $initials  = strtoupper(mb_substr($disp_name, 0, 1));
 
 // Load public sessions
 $sessions = $pdo->prepare("
-    SELECT id, name, occasion, mystery_set, subject_name, photo_path, slug, created_at
+    SELECT id, name, occasion, mystery_set, subject_name, photo_path,
+           photo_focal_x, photo_focal_y, photo_zoom, slug, created_at
     FROM   sessions
     WHERE  user_id = ? AND is_public = 1 AND occasion != 'novena_deceased'
     ORDER  BY created_at DESC
@@ -45,7 +47,8 @@ $sessions = $sessions->fetchAll();
 
 // Load public novena groups
 $novenas = $pdo->prepare("
-    SELECT ng.id, ng.name, ng.mystery_set, ng.subject_name, ng.photo_path, ng.slug, ng.created_at,
+    SELECT ng.id, ng.name, ng.mystery_set, ng.subject_name, ng.photo_path,
+           ng.photo_focal_x, ng.photo_focal_y, ng.photo_zoom, ng.slug, ng.created_at,
            COUNT(s.id) AS day_count
     FROM   novena_groups ng
     LEFT   JOIN sessions s ON s.novena_group_id = ng.id
@@ -127,7 +130,7 @@ $occasion_labels = [
             <?php if (!empty($row['photo_path'])): ?>
                 <img class="rosary-card-photo"
                      src="<?= htmlspecialchars('/' . ltrim($row['photo_path'], '/')) ?>"
-                     alt="">
+                     alt="" style="<?= htmlspecialchars(photo_crop_style($row)) ?>">
             <?php else: ?>
                 <div class="rosary-card-photo-placeholder">&#x271D;</div>
             <?php endif; ?>