Seed provenance + inventory: source links and seed lots (#50) (#64)

Co-authored-by: Steve Dudenhoeffer <[email protected]>

internal/api/api.go

@@ -124,6 +124,15 @@ func New(cfg *config.Config, svc *service.Service) *gin.Engine {
 	plants.PATCH("/:id", h.updatePlant)
 	plants.DELETE("/:id", h.deletePlant)
 
+	// Seed lots: what the actor bought, and what's left. Private to the buyer,
+	// so these hang off the session actor rather than off a garden.
+	seedLots := v1.Group("/seed-lots", h.requireAuth())
+	seedLots.GET("", h.listSeedLots)
+	seedLots.POST("", h.createSeedLot)
+	seedLots.GET("/:id", h.getSeedLot)
+	seedLots.PATCH("/:id", h.updateSeedLot)
+	seedLots.DELETE("/:id", h.deleteSeedLot)
+
 	// Public, unauthenticated read of a garden by its share token. Deliberately
 	// NOT behind requireAuth: the token is the capability, so a logged-out visitor
 	// opens a shared link without being redirected to /login or OIDC. Only GET,