Address Gadfly review on #14: bounds trap, date order, count cap

- UpdatePlanting: only re-check the object-bounds when the position is actually
  being moved. A plop orphaned outside its object by a later resize stays
  editable/removable instead of becoming a row you can't fix or delete.
- finalizePlanting: reject removed_at before planted_at.
- derivedCount: guard Inf (not just NaN) and cap the result at maxExplicitCount
  (1e6) — the same ceiling a manual override honors — so a huge radius / tiny
  spacing can't overflow a 32-bit int or return an absurd value.
- Refresh stale docs that referenced #14 as not-yet-landed (FullGarden,
  ListActivePlantingsForGarden, ListReferencedPlants) and note the date-only
  layout beside timeLayout.

Deliberately did NOT add a plantable re-check to Update/Delete: existing plops
must stay editable/removable even if their object was later marked non-plantable
(same trap as the bounds case).

Tests: derived-count cap, removed-before-planted rejection, and edit/move of a
plop orphaned by an object shrink.

Co-Authored-By: Claude Opus 4.8 (1M context) <[email protected]>
Claude-Session: https://claude.ai/code/session_01JdQpdYYsTgtkJBxbcpAszi

internal/service/service.go

@@ -20,9 +20,11 @@ import (
 	"gitea.stevedudenhoeffer.com/steve/pansy/internal/store"
 )
 
-// timeLayout is the ISO-8601 UTC format used for every timestamp pansy stores.
-// It matches the schema's strftime('%Y-%m-%dT%H:%M:%SZ') so string comparison
-// (e.g. session expiry) is equivalent to time comparison.
+// timeLayout is the ISO-8601 UTC format used for every full timestamp pansy
+// stores (created_at/updated_at/expires_at). It matches the schema's
+// strftime('%Y-%m-%dT%H:%M:%SZ') so string comparison (e.g. session expiry) is
+// equivalent to time comparison. Date-only fields (planting planted_at/
+// removed_at) use dateLayout instead.
 const timeLayout = "2006-01-02T15:04:05Z"
 
 // sessionTTL is how long a session lives from its last use (sliding expiry).