Add plant catalog backend: CRUD + seeded built-ins (#12)

Extends the plants store (which had only the /full read side) with full
catalog CRUD, adds a service layer with visibility/immutability rules, REST
endpoints, and a seed migration of ~32 built-ins.

- 0003_seed_plants.sql: 32 built-in plants (owner_id NULL, read-only), seeded
  once by the version-tracked migration runner.
- store: ListPlantsForActor (built-ins + own), Get/Create/Update/Delete +
  CountPlantingsForPlant; isForeignKeyViolation backstop for the RESTRICT FK.
- service: built-ins are read-only (ErrForbidden); another user's plants are
  invisible (ErrNotFound); delete of a referenced plant → ErrPlantInUse (409);
  validation mirrors the schema (category enum, spacing>0, hex color, icon).
- api: GET,POST /plants and PATCH,DELETE /plants/:id with the version guard.
- Made the migration-count store tests derive their expectation from the files
  so future migrations don't break them.

Service + API tests cover visibility, built-in immutability, validation,
version conflict, and delete-in-use.

Co-Authored-By: Claude Opus 4.8 (1M context) <[email protected]>
Claude-Session: https://claude.ai/code/session_01JdQpdYYsTgtkJBxbcpAszi

internal/api/plants_test.go

@@ -0,0 +1,100 @@
+package api
+
+import (
+	"encoding/json"
+	"net/http"
+	"strconv"
+	"testing"
+)
+
+func plantPath(id int64) string {
+	return "/api/v1/plants/" + strconv.FormatInt(id, 10)
+}
+
+// firstBuiltinID returns the id of a seeded built-in (no ownerId key) from a
+// /plants list response, plus the total count.
+func firstBuiltinID(t *testing.T, body []byte) (int64, int) {
+	t.Helper()
+	var list []map[string]any
+	if err := json.Unmarshal(body, &list); err != nil {
+		t.Fatalf("decode plants list: %v (body %s)", err, body)
+	}
+	for _, p := range list {
+		if _, owned := p["ownerId"]; !owned {
+			return int64(p["id"].(float64)), len(list)
+		}
+	}
+	t.Fatal("no built-in plant in list")
+	return 0, 0
+}
+
+func TestPlantCatalogFlow(t *testing.T) {
+	r := authEngine(t, localCfg())
+	cookie := registerAndCookie(t, r, "[email protected]")
+
+	// List → seeded built-ins present.
+	w := doJSON(t, r, http.MethodGet, "/api/v1/plants", nil, cookie)
+	if w.Code != http.StatusOK {
+		t.Fatalf("list status = %d, body %s", w.Code, w.Body.String())
+	}
+	builtinID, count := firstBuiltinID(t, w.Body.Bytes())
+	if count < 30 {
+		t.Errorf("catalog = %d plants, want >= 30 seeded", count)
+	}
+
+	// Create a custom plant → 201.
+	w = doJSON(t, r, http.MethodPost, "/api/v1/plants",
+		map[string]any{"name": "My tomato", "category": "vegetable", "spacingCm": 55, "color": "#e53935", "icon": "🍅"}, cookie)
+	if w.Code != http.StatusCreated {
+		t.Fatalf("create status = %d, body %s", w.Code, w.Body.String())
+	}
+	created := decodeMap(t, w.Body.Bytes())
+	id := int64(created["id"].(float64))
+	if created["ownerId"] == nil {
+		t.Error("custom plant should carry ownerId")
+	}
+
+	// Patch the custom plant with its version → 200, bumped.
+	w = doJSON(t, r, http.MethodPatch, plantPath(id), map[string]any{"spacingCm": 50, "version": 1}, cookie)
+	if w.Code != http.StatusOK {
+		t.Fatalf("patch status = %d, body %s", w.Code, w.Body.String())
+	}
+	if decodeMap(t, w.Body.Bytes())["version"].(float64) != 2 {
+		t.Error("patch didn't bump version")
+	}
+
+	// A built-in is read-only: patch and delete both → 403.
+	if w := doJSON(t, r, http.MethodPatch, plantPath(builtinID), map[string]any{"spacingCm": 99, "version": 1}, cookie); w.Code != http.StatusForbidden {
+		t.Errorf("patch built-in = %d, want 403", w.Code)
+	}
+	if w := doJSON(t, r, http.MethodDelete, plantPath(builtinID), nil, cookie); w.Code != http.StatusForbidden {
+		t.Errorf("delete built-in = %d, want 403", w.Code)
+	}
+
+	// Delete the custom plant → 204.
+	if w := doJSON(t, r, http.MethodDelete, plantPath(id), nil, cookie); w.Code != http.StatusNoContent {
+		t.Errorf("delete custom = %d, want 204", w.Code)
+	}
+}
+
+func TestPlantVisibilityAcrossUsersAPI(t *testing.T) {
+	r := authEngine(t, localCfg())
+	alice := registerAndCookie(t, r, "[email protected]")
+	bob := registerAndCookie(t, r, "[email protected]")
+
+	w := doJSON(t, r, http.MethodPost, "/api/v1/plants",
+		map[string]any{"name": "Alice mint", "category": "herb", "spacingCm": 30, "color": "#66bb6a", "icon": "🌿"}, alice)
+	id := int64(decodeMap(t, w.Body.Bytes())["id"].(float64))
+
+	// Bob can't see it → editing masks as 404, not 403.
+	if w := doJSON(t, r, http.MethodPatch, plantPath(id), map[string]any{"name": "x", "version": 1}, bob); w.Code != http.StatusNotFound {
+		t.Errorf("bob patch alice's plant = %d, want 404", w.Code)
+	}
+}
+
+func TestPlantsRequireAuth(t *testing.T) {
+	r := authEngine(t, localCfg())
+	if w := doJSON(t, r, http.MethodGet, "/api/v1/plants", nil, nil); w.Code != http.StatusUnauthorized {
+		t.Errorf("unauthenticated list = %d, want 401", w.Code)
+	}
+}