Address Gadfly review on #16: RemoveShare choke point + dedup

- RemoveShare now routes through requireGardenRole(roleViewer) — the standard
  authorization choke point (masks existence for non-participants) — then applies
  the owner-or-self rule on top (a participant removing someone else's share is
  now ErrForbidden, not ErrNotFound). No more bespoke GetGarden+manual check.
- Add domain.RoleOwner constant; gardenRole.String() and the tests use it instead
  of the bare "owner" literal.
- UpdatePlanting fetches the plant once and only re-checks visibility when the
  plant id actually CHANGES (new ≠ old), so a no-op plantId resend can't break a
  shared editor editing a plop that uses the owner's private plant.
- Bound ListSharesForGarden with a LIMIT backstop.

Skipped: AddShare email-existence disclosure (the issue explicitly accepts it as
inherent to email-based sharing), 404-on-missing-share (correct DELETE
semantics), and the join-scan/test-helper dedup nits.

GOWORK=off go build/vet/test ./internal/... green.

Co-Authored-By: Claude Opus 4.8 (1M context) <[email protected]>
Claude-Session: https://claude.ai/code/session_01JdQpdYYsTgtkJBxbcpAszi

internal/store/shares.go

@@ -40,6 +40,10 @@ func (d *DB) GetShareRole(ctx context.Context, gardenID, userID int64) (role str
 	return role, true, nil
 }
 
+// maxSharesListed bounds a garden's share list defensively (a garden is shared
+// with a handful of people at household scale; this is never hit).
+const maxSharesListed = 1000
+
 // ListSharesForGarden returns a garden's shares joined with each recipient's
 // email and display name, for the sharing UI. Always a non-nil slice.
 func (d *DB) ListSharesForGarden(ctx context.Context, gardenID int64) ([]domain.ShareWithUser, error) {
@@ -47,8 +51,9 @@ func (d *DB) ListSharesForGarden(ctx context.Context, gardenID int64) ([]domain.
 		`SELECT `+qualifyColumns("s", shareColumns)+`, u.email, u.display_name
 		   FROM garden_shares s JOIN users u ON u.id = s.user_id
 		  WHERE s.garden_id = ?
-		  ORDER BY u.display_name COLLATE NOCASE, s.id`,
-		gardenID,
+		  ORDER BY u.display_name COLLATE NOCASE, s.id
+		  LIMIT ?`,
+		gardenID, maxSharesListed,
 	)
 	if err != nil {
 		return nil, fmt.Errorf("store: list shares: %w", err)