Copy a garden (deep duplicate) from the gardens list

Adds POST /gardens/:id/copy: duplicates a garden the actor owns, along
with its objects and their currently-planted plops, into a new garden
owned by the actor. A blank name derives "<source> (copy)".

Deliberately not carried over:
  * public_token — the share link is a capability granted to the
    original; a copy must not silently inherit a live public URL
  * garden_shares — a copy is private to whoever made it
  * removed plantings — the copy is a fresh layout, not a history

Owner-only for now: a copy's plops keep pointing at the SOURCE's
plant_ids, so letting a viewer copy someone else's garden would hand
them plants outside their catalog and pin the original owner's plants
against deletion (plantings.plant_id is ON DELETE RESTRICT). Copying a
shared garden needs a plant-cloning policy first.

The whole copy runs in one transaction, so a failure part-way leaves no
half-populated garden. The object/planting list scans are factored into
queryObjects/queryPlantings so the same code serves a plain read and a
read inside that transaction.

UI: a Copy action on the owner's garden card opens a modal prefilled
with the derived name, then lands in the new garden.

Co-Authored-By: Claude Opus 4.8 (1M context) <[email protected]>

internal/store/gardens.go

@@ -163,6 +163,101 @@ func (d *DB) DeleteGarden(ctx context.Context, id int64) error {
 	return nil
 }
 
+// CopyGarden deep-copies garden srcID into a new garden owned by ownerID and
+// named name, returning the new row. Objects are copied with their geometry,
+// grid settings and z-order, and each object's ACTIVE plantings (removed_at IS
+// NULL) are re-parented onto the copied object.
+//
+// Deliberately not copied:
+//   - public_token — the share link is a capability granted to the original, so a
+//     copy must not silently inherit a live public URL;
+//   - garden_shares — a copy is private to whoever made it;
+//   - removed plantings — the copy is a fresh layout, not the original's history.
+//
+// The whole copy runs in one transaction, so a failure part-way leaves no
+// half-populated garden behind. Returns domain.ErrNotFound if srcID is gone.
+func (d *DB) CopyGarden(ctx context.Context, srcID, ownerID int64, name string) (*domain.Garden, error) {
+	tx, err := d.sql.BeginTx(ctx, nil)
+	if err != nil {
+		return nil, fmt.Errorf("store: begin copy garden tx: %w", err)
+	}
+	defer tx.Rollback() //nolint:errcheck // no-op after a successful commit
+
+	// INSERT ... SELECT copies the source's own columns; owner and name are
+	// supplied. If the source is gone the SELECT is empty, nothing is inserted,
+	// and RETURNING yields no rows.
+	created, err := scanGarden(tx.QueryRowContext(ctx,
+		`INSERT INTO gardens (owner_id, name, width_cm, height_cm, unit_pref, notes, grid_size_cm, snap_to_grid)
+		 SELECT ?, ?, width_cm, height_cm, unit_pref, notes, grid_size_cm, snap_to_grid
+		   FROM gardens WHERE id = ?
+		 RETURNING `+gardenColumns,
+		ownerID, name, srcID,
+	))
+	if errors.Is(err, sql.ErrNoRows) {
+		return nil, domain.ErrNotFound
+	}
+	if err != nil {
+		return nil, fmt.Errorf("store: copy garden: %w", err)
+	}
+
+	// Read the source's objects fully before inserting: SQLite can't have an open
+	// cursor and a write on the same connection, and the pool is pinned to one
+	// connection for in-memory DBs.
+	srcObjects, err := queryObjects(ctx, tx,
+		`SELECT `+objectColumns+` FROM garden_objects WHERE garden_id = ? ORDER BY id`, srcID)
+	if err != nil {
+		return nil, err
+	}
+
+	// objectIDs maps a source object id to its copy, so plantings can be
+	// re-parented onto the right new object.
+	objectIDs := make(map[int64]int64, len(srcObjects))
+	for _, o := range srcObjects {
+		copied, err := scanObject(tx.QueryRowContext(ctx,
+			`INSERT INTO garden_objects
+			   (garden_id, kind, name, shape, points, x_cm, y_cm, width_cm, height_cm,
+			    rotation_deg, z_index, plantable, color, props, grid_size_cm, snap_to_grid, notes)
+			 VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)
+			 RETURNING `+objectColumns,
+			created.ID, o.Kind, o.Name, o.Shape, o.Points, o.XCM, o.YCM, o.WidthCM, o.HeightCM,
+			o.RotationDeg, o.ZIndex, boolToInt(o.Plantable), o.Color, o.Props,
+			o.GridSizeCM, boolToInt(o.SnapToGrid), o.Notes,
+		))
+		if err != nil {
+			return nil, fmt.Errorf("store: copy object: %w", err)
+		}
+		objectIDs[o.ID] = copied.ID
+	}
+
+	srcPlantings, err := queryPlantings(ctx, tx,
+		`SELECT `+qualifyColumns("pl", plantingColumns)+` FROM plantings pl
+		   JOIN garden_objects o ON o.id = pl.object_id
+		  WHERE o.garden_id = ? AND pl.removed_at IS NULL
+		  ORDER BY pl.id`, srcID)
+	if err != nil {
+		return nil, err
+	}
+	for _, p := range srcPlantings {
+		objectID, ok := objectIDs[p.ObjectID]
+		if !ok {
+			// Unreachable: every active planting joins an object we just copied.
+			return nil, fmt.Errorf("store: copy planting %d: source object %d not copied", p.ID, p.ObjectID)
+		}
+		if _, err := tx.ExecContext(ctx,
+			`INSERT INTO plantings (object_id, plant_id, x_cm, y_cm, radius_cm, count, label, planted_at)
+			 VALUES (?, ?, ?, ?, ?, ?, ?, ?)`,
+			objectID, p.PlantID, p.XCM, p.YCM, p.RadiusCM, p.Count, p.Label, p.PlantedAt,
+		); err != nil {
+			return nil, fmt.Errorf("store: copy planting: %w", err)
+		}
+	}
+
+	if err := tx.Commit(); err != nil {
+		return nil, fmt.Errorf("store: commit garden copy: %w", err)
+	}
+	return created, nil
+}
+
 // GetGardenByPublicToken returns the garden whose public_token matches, or
 // domain.ErrNotFound. Possession of the token is the capability, so there is no
 // owner/actor check here — the service exposes this only for the unauthenticated