Fix zoomed photo preview overflowing its box; cache-bust crop assets

Reported: on the session edit page, the photo preview rendered larger
than the rest of the form and overlapped the upload button below it.

Cause: transform:scale(zoom) only affects paint, not layout — the
preview's wrapper (.photo-preview-wrap, .novena-hero-photo-wrap) never
had overflow:hidden, so a zoomed-in crop visually spilled outside its
intended max-height/max-width box instead of being clipped to it. Cards
elsewhere were already fine (.rosary-card already has overflow:hidden).

Also: photo-crop.js/css had no cache-busting query string on any of their
three <script>/<link> tags, so a browser that loaded a page before this
feature's most recent update could easily keep serving a stale cached
copy indefinitely — added ?v=2 to force a refetch of this round's fix.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

admin/setup.php

@@ -48,7 +48,7 @@ $page_title = $session ? 'Edit Session' : 'New Session';
     <link rel="icon" type="image/svg+xml" href="<?= BASE_URL ?>/favicon.svg">
     <title><?= $page_title ?> — <?= htmlspecialchars($site_name) ?></title>
     <link rel="stylesheet" href="<?= BASE_URL ?>/assets/css/setup.css">
-    <link rel="stylesheet" href="<?= BASE_URL ?>/assets/css/photo-crop.css">
+    <link rel="stylesheet" href="<?= BASE_URL ?>/assets/css/photo-crop.css?v=2">
     <meta name="csrf-token" content="<?= htmlspecialchars(csrf_token()) ?>">
     <script>var BASE_URL = '<?= BASE_URL ?>';</script>
 </head>
@@ -259,7 +259,7 @@ $page_title = $session ? 'Edit Session' : 'New Session';
         </main>
     </div>
 
-    <script src="<?= BASE_URL ?>/assets/js/photo-crop.js"></script>
+    <script src="<?= BASE_URL ?>/assets/js/photo-crop.js?v=2"></script>
     <script src="<?= BASE_URL ?>/assets/js/setup.js?v=5"></script>
 </body>
 </html>