Address Gadfly review on #19: batch fills + tighten Region

- FillRegion: insert the whole batch in one transaction (store.CreatePlantings)
  instead of one round-trip per plop, and refuse fills over maxFillPlops (5000)
  so a max-sized bed with tiny spacing can't generate ~10^5 sequential writes.
  Guards the computed radius is finite/positive and clamps the region to the
  object's bounds before packing (bounds hexCenters).
- FillNamedRegion + FillRegion share a fillLoaded body, so the object is loaded
  and authorized once (no double objectForRole).
- Region is now rect-only — dropped the speculative circle fields/branch that
  NamedRegion never produced and hexCenters didn't pack (circles are post-v1).
- NamedRegion guards a nil object and no longer maps a blank name to "all"
  (blank → ErrInvalidInput, matching the doc).
- ClearObject documents why it deliberately doesn't require plantable.

Tests: empty/nil region name → ErrInvalidInput; an oversized fill → ErrInvalidInput
(over the cap). Tagged demo tidied (checked errors, domain.RoleViewer, t.Helper).

GOWORK=off go build/vet/test ./internal/... green; tagged agent test green against
majordomo (go.mod stays majordomo-free).

Co-Authored-By: Claude Opus 4.8 (1M context) <[email protected]>
Claude-Session: https://claude.ai/code/session_01JdQpdYYsTgtkJBxbcpAszi

internal/service/ops_test.go

@@ -41,6 +41,25 @@ func TestNamedRegion(t *testing.T) {
 	if _, err := NamedRegion(o, "middle-ish"); !errors.Is(err, domain.ErrInvalidInput) {
 		t.Errorf("unknown region err = %v, want ErrInvalidInput", err)
 	}
+	if _, err := NamedRegion(o, ""); !errors.Is(err, domain.ErrInvalidInput) {
+		t.Errorf("empty region err = %v, want ErrInvalidInput", err)
+	}
+	if _, err := NamedRegion(nil, "all"); !errors.Is(err, domain.ErrInvalidInput) {
+		t.Errorf("nil object err = %v, want ErrInvalidInput", err)
+	}
+}
+
+func TestFillRegionCappedForHugeArea(t *testing.T) {
+	ctx := context.Background()
+	s := newTestService(t, openConfig())
+	owner := seedUser(t, s, "[email protected]")
+	g, _ := s.CreateGarden(ctx, owner, GardenInput{Name: "Huge", WidthCM: 8000, HeightCM: 8000})
+	bed := seedFillBed(t, s, owner, g.ID, 6000, 6000) // ~46k lattice points at radius 15 → over the cap
+	plant := seedOwnPlant(t, s, owner, 10)
+	region, _ := NamedRegion(bed, "all")
+	if _, err := s.FillRegion(ctx, owner, bed.ID, region, plant.ID, nil); !errors.Is(err, domain.ErrInvalidInput) {
+		t.Errorf("oversized fill err = %v, want ErrInvalidInput (over maxFillPlops)", err)
+	}
 }
 
 func TestDefaultPlopRadius(t *testing.T) {