Address Gadfly review on #14: bounds trap, date order, count cap

- UpdatePlanting: only re-check the object-bounds when the position is actually
  being moved. A plop orphaned outside its object by a later resize stays
  editable/removable instead of becoming a row you can't fix or delete.
- finalizePlanting: reject removed_at before planted_at.
- derivedCount: guard Inf (not just NaN) and cap the result at maxExplicitCount
  (1e6) — the same ceiling a manual override honors — so a huge radius / tiny
  spacing can't overflow a 32-bit int or return an absurd value.
- Refresh stale docs that referenced #14 as not-yet-landed (FullGarden,
  ListActivePlantingsForGarden, ListReferencedPlants) and note the date-only
  layout beside timeLayout.

Deliberately did NOT add a plantable re-check to Update/Delete: existing plops
must stay editable/removable even if their object was later marked non-plantable
(same trap as the bounds case).

Tests: derived-count cap, removed-before-planted rejection, and edit/move of a
plop orphaned by an object shrink.

Co-Authored-By: Claude Opus 4.8 (1M context) <[email protected]>
Claude-Session: https://claude.ai/code/session_01JdQpdYYsTgtkJBxbcpAszi

internal/service/objects.go

@@ -69,8 +69,8 @@ type ObjectPatch struct {
 }
 
 // FullGarden is the one-shot editor payload: the garden plus everything drawn in
-// it. Plantings/Plants stay empty until #14 populates plantings; the shape is
-// fixed now so the frontend types against it once.
+// it — objects, active plantings (each with its DerivedCount filled in), and the
+// plants those plantings reference.
 type FullGarden struct {
 	Garden    *domain.Garden        `json:"garden"`
 	Objects   []domain.GardenObject `json:"objects"`