Add Square deposit payment integration

- Square Web Payments SDK card element in booking form
- Delayed-capture hold ($100) on booking submit — not charged until confirmed
- Live payment status field: Verifying card → Authorizing → Confirmed w/ hold ID
- Admin: Capture / Void / Refund actions for each booking
- square_payment_id returned in API response for frontend confirmation display

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

db.php

@@ -13,6 +13,12 @@ define('MAIL_FROM',       'noreply@parkerslingshotrentals.com');
 define('MAIL_FROM_NAME',  'Parker County Slingshot Rentals');
 define('ADMIN_EMAIL',     'info@parkerslingshotrentals.com');
 
+define('SQUARE_ACCESS_TOKEN', 'EAAAl3FsAu_2ri8kZE_ENEyi2T_C8HXXm5XQFY6Lbnd8SX6FqYp8J_upUeXNYh7v');
+define('SQUARE_APP_ID',       'sq0idp-YSM7BU9IVyOWSzpeP-0nzQ');
+define('SQUARE_LOCATION_ID',  'L8GZYHYKE95CE');
+define('SQUARE_VERSION',      '2024-01-18');
+define('DEPOSIT_AMOUNT',       100.00); // $100 refundable security deposit hold
+
 define('PACKAGES', [
     'half-day' => ['label' => 'Half Day (4 hrs)',    'amount' => 99.00,  'days' => 0],
     'full-day' => ['label' => 'Full Day (8 hrs)',     'amount' => 169.00, 'days' => 0],
@@ -31,6 +37,24 @@ function db(): PDO {
     return $pdo;
 }
 
+function squareApi(string $method, string $path, array $body = []): array {
+    $ch = curl_init('https://connect.squareup.com/v2' . $path);
+    $headers = [
+        'Authorization: Bearer ' . SQUARE_ACCESS_TOKEN,
+        'Content-Type: application/json',
+        'Square-Version: ' . SQUARE_VERSION,
+    ];
+    $opts = [CURLOPT_RETURNTRANSFER => true, CURLOPT_HTTPHEADER => $headers, CURLOPT_TIMEOUT => 30, CURLOPT_SSL_VERIFYPEER => false];
+    if ($method === 'POST') {
+        $opts[CURLOPT_POST]       = true;
+        $opts[CURLOPT_POSTFIELDS] = $body ? json_encode($body) : '{}';
+    }
+    curl_setopt_array($ch, $opts);
+    $resp = curl_exec($ch);
+    curl_close($ch);
+    return json_decode($resp ?: '{}', true);
+}
+
 function generateRef(): string {
     return 'PSR-' . strtoupper(substr(uniqid(), -6));
 }