Address review: redact plant owner ids, cache-control, 400, DRY reset

- Security (2-model, security+correctness): the public payload zeroed
  Garden.OwnerID but referenced custom plants still carried Plant.OwnerID,
  leaking the owner's user id to anonymous viewers. Redact plant owner ids
  too, and assert it in the service test.
- Set Cache-Control: no-store on the public read so a capability-URL response
  isn't held in a shared proxy cache and always reflects the live garden.
- createShareLink now 400s on a present-but-malformed JSON body instead of
  silently enabling (an empty body still means enable-without-rotate).
- Extract the transient-editor-state reset into a shared resetTransient store
  action (3-model finding) and use it from PublicGardenPage.

Co-Authored-By: Claude Opus 4.8 (1M context) <[email protected]>
Claude-Session: https://claude.ai/code/session_01JdQpdYYsTgtkJBxbcpAszi

internal/api/public.go

@@ -1,6 +1,8 @@
 package api
 
 import (
+	"errors"
+	"io"
 	"net/http"
 
 	"github.com/gin-gonic/gin"
@@ -16,6 +18,10 @@ func (h *handlers) getPublicGarden(c *gin.Context) {
 		writeServiceError(c, err)
 		return
 	}
+	// The token is a capability in the URL: keep the response out of any shared
+	// proxy cache, and always serve the live garden (the owner may have edited or
+	// revoked it since the last view).
+	c.Header("Cache-Control", "no-store")
 	c.JSON(http.StatusOK, full)
 }
 
@@ -45,7 +51,12 @@ func (h *handlers) createShareLink(c *gin.Context) {
 	var req struct {
 		Rotate bool `json:"rotate"`
 	}
-	_ = c.ShouldBindJSON(&req)
+	// The body is optional (an empty body means enable-without-rotate), but a
+	// present-yet-malformed body is a client error, not a silent enable.
+	if err := c.ShouldBindJSON(&req); err != nil && !errors.Is(err, io.EOF) {
+		writeAPIError(c, http.StatusBadRequest, "INVALID_INPUT", "invalid request body")
+		return
+	}
 	link, err := h.svc.EnablePublicShareLink(c.Request.Context(), mustActor(c).ID, id, req.Rotate)
 	if err != nil {
 		writeServiceError(c, err)