Address Gadfly review on #16: RemoveShare choke point + dedup

- RemoveShare now routes through requireGardenRole(roleViewer) — the standard
  authorization choke point (masks existence for non-participants) — then applies
  the owner-or-self rule on top (a participant removing someone else's share is
  now ErrForbidden, not ErrNotFound). No more bespoke GetGarden+manual check.
- Add domain.RoleOwner constant; gardenRole.String() and the tests use it instead
  of the bare "owner" literal.
- UpdatePlanting fetches the plant once and only re-checks visibility when the
  plant id actually CHANGES (new ≠ old), so a no-op plantId resend can't break a
  shared editor editing a plop that uses the owner's private plant.
- Bound ListSharesForGarden with a LIMIT backstop.

Skipped: AddShare email-existence disclosure (the issue explicitly accepts it as
inherent to email-based sharing), 404-on-missing-share (correct DELETE
semantics), and the join-scan/test-helper dedup nits.

GOWORK=off go build/vet/test ./internal/... green.

Co-Authored-By: Claude Opus 4.8 (1M context) <[email protected]>
Claude-Session: https://claude.ai/code/session_01JdQpdYYsTgtkJBxbcpAszi

internal/service/gardens.go

@@ -36,7 +36,7 @@ const (
 func (r gardenRole) String() string {
 	switch r {
 	case roleOwner:
-		return "owner"
+		return domain.RoleOwner
 	case roleEditor:
 		return domain.RoleEditor
 	case roleViewer: