Address Gadfly review on #14: bounds trap, date order, count cap

- UpdatePlanting: only re-check the object-bounds when the position is actually
  being moved. A plop orphaned outside its object by a later resize stays
  editable/removable instead of becoming a row you can't fix or delete.
- finalizePlanting: reject removed_at before planted_at.
- derivedCount: guard Inf (not just NaN) and cap the result at maxExplicitCount
  (1e6) — the same ceiling a manual override honors — so a huge radius / tiny
  spacing can't overflow a 32-bit int or return an absurd value.
- Refresh stale docs that referenced #14 as not-yet-landed (FullGarden,
  ListActivePlantingsForGarden, ListReferencedPlants) and note the date-only
  layout beside timeLayout.

Deliberately did NOT add a plantable re-check to Update/Delete: existing plops
must stay editable/removable even if their object was later marked non-plantable
(same trap as the bounds case).

Tests: derived-count cap, removed-before-planted rejection, and edit/move of a
plop orphaned by an object shrink.

Co-Authored-By: Claude Opus 4.8 (1M context) <[email protected]>
Claude-Session: https://claude.ai/code/session_01JdQpdYYsTgtkJBxbcpAszi

internal/api/plantings_test.go

@@ -51,7 +51,7 @@ func TestPlantingCreatePatchFullDelete(t *testing.T) {
 	}
 
 	// Soft-remove (clear-bed style) → it leaves /full.
-	w = doJSON(t, r, http.MethodPatch, plantingPath(pid), map[string]any{"removedAt": "2026-07-01", "version": 1}, cookie)
+	w = doJSON(t, r, http.MethodPatch, plantingPath(pid), map[string]any{"removedAt": "2030-06-01", "version": 1}, cookie)
 	if w.Code != http.StatusOK {
 		t.Fatalf("soft-remove: status %d, body %s", w.Code, w.Body.String())
 	}