Address Gadfly review on #14: bounds trap, date order, count cap

- UpdatePlanting: only re-check the object-bounds when the position is actually
  being moved. A plop orphaned outside its object by a later resize stays
  editable/removable instead of becoming a row you can't fix or delete.
- finalizePlanting: reject removed_at before planted_at.
- derivedCount: guard Inf (not just NaN) and cap the result at maxExplicitCount
  (1e6) — the same ceiling a manual override honors — so a huge radius / tiny
  spacing can't overflow a 32-bit int or return an absurd value.
- Refresh stale docs that referenced #14 as not-yet-landed (FullGarden,
  ListActivePlantingsForGarden, ListReferencedPlants) and note the date-only
  layout beside timeLayout.

Deliberately did NOT add a plantable re-check to Update/Delete: existing plops
must stay editable/removable even if their object was later marked non-plantable
(same trap as the bounds case).

Tests: derived-count cap, removed-before-planted rejection, and edit/move of a
plop orphaned by an object shrink.

Co-Authored-By: Claude Opus 4.8 (1M context) <[email protected]>
Claude-Session: https://claude.ai/code/session_01JdQpdYYsTgtkJBxbcpAszi

internal/store/plantings.go

@@ -28,8 +28,7 @@ func scanPlanting(s scanner) (*domain.Planting, error) {
 
 // ListActivePlantingsForGarden returns every currently-planted plop (removed_at
 // IS NULL) across all objects in a garden — the editor's one-shot load. Always a
-// non-nil slice (empty until plantings CRUD lands in #14). Plop CRUD itself is
-// #14; this is only the /full read side.
+// non-nil slice. The service fills each row's DerivedCount; this is the raw read.
 func (d *DB) ListActivePlantingsForGarden(ctx context.Context, gardenID int64) ([]domain.Planting, error) {
 	rows, err := d.sql.QueryContext(ctx,
 		`SELECT `+qualifyColumns("pl", plantingColumns)+` FROM plantings pl