Add online menu management, modernized and hardened

Adds a public menu page (menu.php) and an admin CRUD interface
(admin/menu.php + admin/menu.js) backed by new menu_categories and
menu_items tables, replacing the "menu lives on Facebook" placeholder
on the homepage.

The admin JS/PHP came out of an AI-assisted pass that used outdated
JS (var, .then() chains, string-built HTML) and had some rough edges
security-wise, so this also:

- Rewrites the admin JS to modern ES (const/let, async/await,
  template literals, dataset API) and splits it out of admin/menu.php
  into admin/menu.js for proper separation of concerns
- Adds declare(strict_types=1) and PHP 8 match-based action dispatch
  in place of an if-chain
- Validates category_id/item_id/category_id server-side before use,
  so a bad ID returns a clean JSON error instead of an uncaught
  PDOException or a null item breaking the client
- Rejects non-string POST fields instead of crashing trim() on them
- Replaces the category-save handler's full-page location.reload()
  with in-place DOM updates (panel insert/update, resort by
  sort_order, keep the item modal's category dropdown in sync), so
  every admin action is now AJAX with no reload
- Sets data-name/data-desc via dataset assignment rather than string-
  interpolating them into an HTML attribute, closing a stored-XSS
  path through the category name/description fields

Removes seed-menu.php, a leftover stub with no working code left in
it after the AI's one-time seeding run.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

admin/index.php

@@ -76,6 +76,10 @@ $today = date('Y-m-d');
         <img src="../assets/knot.png" alt="" class="knot">
         <span>The Old Fitz Admin</span>
       </a>
+      <div class="admin-nav-links">
+        <a href="index.php" class="active">Announcements</a>
+        <a href="menu.php">Menu</a>
+      </div>
       <div class="admin-user">
         <span>Logged in as <strong><?= htmlspecialchars($user['username']) ?></strong></span>
         <a href="../" target="_blank" rel="noopener">View Public Site ↗</a>