Add plantings backend: plop CRUD, derived counts, removed_at (#14)

- domain: Planting gains a computed (non-persisted) DerivedCount field.
- store/plantings.go: Get/Create/Update (version-guarded)/Delete alongside the
  existing /full read helper.
- service/plantings.go: place/move/resize/soft-remove a plop; editor role on the
  object's garden; object must be plantable; plant_id must be visible to the
  actor (built-in or own) else ErrInvalidInput; center must sit within the
  object's unrotated local bounds (radius may overhang); planted_at defaults to
  today. derivedCount = max(1, round(π·r²/spacing²)) — one unit-tested helper,
  reused by /full (via a spacing map, no N+1) and single responses.
- api: POST /objects/:id/plantings, PATCH/DELETE /plantings/:id; nullable
  count/label/plantedAt/removedAt use RawMessage so null (clear) is distinct
  from absent (unchanged). removedAt is the soft-remove / "clear bed" seam.
- /full now enriches each active plop with its derivedCount.

Service tests: formula edge cases (tiny radius → 1), defaults + derived, count
override, move/resize + clear override, non-plantable rejection, foreign/unknown
plant rejection, bounds, soft-remove leaves /full, version conflict, cross-user
masking, delete. Plus an API-level create/patch/full/delete flow.

GOWORK=off go build/vet/test ./internal/... green.

Co-Authored-By: Claude Opus 4.8 (1M context) <[email protected]>
Claude-Session: https://claude.ai/code/session_01JdQpdYYsTgtkJBxbcpAszi

internal/api/plantings_test.go

@@ -0,0 +1,99 @@
+package api
+
+import (
+	"encoding/json"
+	"net/http"
+	"strconv"
+	"testing"
+)
+
+func plantingPath(id int64) string        { return "/api/v1/plantings/" + strconv.FormatInt(id, 10) }
+func objectPlantingsPath(id int64) string { return objectPath(id) + "/plantings" }
+
+func TestPlantingCreatePatchFullDelete(t *testing.T) {
+	r := authEngine(t, localCfg())
+	cookie := registerAndCookie(t, r, "[email protected]")
+	gid := createGardenAPI(t, r, cookie, "Yard")
+
+	// A plantable bed centered in the garden.
+	w := doJSON(t, r, http.MethodPost, objectsPath(gid),
+		map[string]any{"kind": "bed", "xCm": 500, "yCm": 500, "widthCm": 200, "heightCm": 200}, cookie)
+	oid := int64(decodeMap(t, w.Body.Bytes())["id"].(float64))
+
+	// A seeded built-in plant to place.
+	w = doJSON(t, r, http.MethodGet, "/api/v1/plants", nil, cookie)
+	plantID, _ := firstBuiltinID(t, w.Body.Bytes())
+
+	// Place a plop → 201 with a derivedCount.
+	w = doJSON(t, r, http.MethodPost, objectPlantingsPath(oid),
+		map[string]any{"plantId": plantID, "xCm": 0, "yCm": 0, "radiusCm": 20}, cookie)
+	if w.Code != http.StatusCreated {
+		t.Fatalf("create planting: status %d, body %s", w.Code, w.Body.String())
+	}
+	pl := decodeMap(t, w.Body.Bytes())
+	pid := int64(pl["id"].(float64))
+	dc, ok := pl["derivedCount"].(float64)
+	if !ok || dc < 1 {
+		t.Errorf("response missing a positive derivedCount: %+v", pl)
+	}
+
+	// /full includes the plop and its referenced plant.
+	w = doJSON(t, r, http.MethodGet, fullPath(gid), nil, cookie)
+	var full struct {
+		Plantings []map[string]any `json:"plantings"`
+		Plants    []map[string]any `json:"plants"`
+	}
+	if err := json.Unmarshal(w.Body.Bytes(), &full); err != nil {
+		t.Fatalf("decode full: %v", err)
+	}
+	if len(full.Plantings) != 1 || len(full.Plants) != 1 {
+		t.Fatalf("full = %d plantings / %d plants, want 1 / 1", len(full.Plantings), len(full.Plants))
+	}
+
+	// Soft-remove (clear-bed style) → it leaves /full.
+	w = doJSON(t, r, http.MethodPatch, plantingPath(pid), map[string]any{"removedAt": "2026-07-01", "version": 1}, cookie)
+	if w.Code != http.StatusOK {
+		t.Fatalf("soft-remove: status %d, body %s", w.Code, w.Body.String())
+	}
+	w = doJSON(t, r, http.MethodGet, fullPath(gid), nil, cookie)
+	full.Plantings = nil
+	json.Unmarshal(w.Body.Bytes(), &full)
+	if len(full.Plantings) != 0 {
+		t.Errorf("removed plop still in /full: %d", len(full.Plantings))
+	}
+
+	// Hard delete → 204.
+	if w := doJSON(t, r, http.MethodDelete, plantingPath(pid), nil, cookie); w.Code != http.StatusNoContent {
+		t.Errorf("delete planting = %d, want 204", w.Code)
+	}
+}
+
+func TestPlantingIntoNonPlantableIsRejected(t *testing.T) {
+	r := authEngine(t, localCfg())
+	cookie := registerAndCookie(t, r, "[email protected]")
+	gid := createGardenAPI(t, r, cookie, "Yard")
+
+	// A tree is not plantable.
+	w := doJSON(t, r, http.MethodPost, objectsPath(gid),
+		map[string]any{"kind": "tree", "xCm": 500, "yCm": 500, "widthCm": 100, "heightCm": 100}, cookie)
+	oid := int64(decodeMap(t, w.Body.Bytes())["id"].(float64))
+
+	w = doJSON(t, r, http.MethodGet, "/api/v1/plants", nil, cookie)
+	plantID, _ := firstBuiltinID(t, w.Body.Bytes())
+
+	w = doJSON(t, r, http.MethodPost, objectPlantingsPath(oid),
+		map[string]any{"plantId": plantID, "xCm": 0, "yCm": 0, "radiusCm": 10}, cookie)
+	if w.Code != http.StatusBadRequest {
+		t.Errorf("plant into tree = %d, want 400", w.Code)
+	}
+}
+
+func TestPlantingsRequireAuth(t *testing.T) {
+	r := authEngine(t, localCfg())
+	if w := doJSON(t, r, http.MethodPost, "/api/v1/objects/1/plantings", map[string]any{"plantId": 1}, nil); w.Code != http.StatusUnauthorized {
+		t.Errorf("unauthenticated create = %d, want 401", w.Code)
+	}
+	if w := doJSON(t, r, http.MethodDelete, "/api/v1/plantings/1", nil, nil); w.Code != http.StatusUnauthorized {
+		t.Errorf("unauthenticated delete = %d, want 401", w.Code)
+	}
+}