Fix zoomed photo preview overflowing its box; cache-bust crop assets

Reported: on the session edit page, the photo preview rendered larger
than the rest of the form and overlapped the upload button below it.

Cause: transform:scale(zoom) only affects paint, not layout — the
preview's wrapper (.photo-preview-wrap, .novena-hero-photo-wrap) never
had overflow:hidden, so a zoomed-in crop visually spilled outside its
intended max-height/max-width box instead of being clipped to it. Cards
elsewhere were already fine (.rosary-card already has overflow:hidden).

Also: photo-crop.js/css had no cache-busting query string on any of their
three <script>/<link> tags, so a browser that loaded a page before this
feature's most recent update could easily keep serving a stale cached
copy indefinitely — added ?v=2 to force a refetch of this round's fix.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

admin/novena_group.php

@@ -137,7 +137,7 @@ $mystery_labels = [
     <link rel="icon" type="image/svg+xml" href="<?= BASE_URL ?>/favicon.svg">
     <title><?= htmlspecialchars($group['name']) ?> — <?= htmlspecialchars($site_name) ?></title>
     <link rel="stylesheet" href="<?= BASE_URL ?>/assets/css/setup.css">
-    <link rel="stylesheet" href="<?= BASE_URL ?>/assets/css/photo-crop.css">
+    <link rel="stylesheet" href="<?= BASE_URL ?>/assets/css/photo-crop.css?v=2">
     <meta name="csrf-token" content="<?= htmlspecialchars(csrf_token()) ?>">
     <script>var BASE_URL = '<?= BASE_URL ?>';</script>
 </head>
@@ -324,7 +324,7 @@ $mystery_labels = [
     </main>
 </div>
 
-<script src="<?= BASE_URL ?>/assets/js/photo-crop.js"></script>
+<script src="<?= BASE_URL ?>/assets/js/photo-crop.js?v=2"></script>
 <script>
 (function () {
     var fileInput      = document.getElementById('photo-file');