Address Gadfly review on the garden copy

* api: detect an absent copy body by io.EOF from the decoder rather than
  Content-Length. A chunked request reports -1, not 0, so the length test
  read an empty chunked body as malformed and 400'd instead of taking the
  default-name path. Covered by a new unknown-length test.

* store: hoist the garden_objects/plantings INSERTs into shared
  objectInsert/plantingInsert statements with matching *InsertArgs
  helpers. CopyGarden had its own copies of both column lists, so a
  column added to the table could be wired into Create* and silently
  dropped from a copy.

* store: move the queryer interface to sqlite.go, next to the other
  shared query plumbing, instead of users.go.

* web: derive a copy's prefilled name via defaultCopyName, mirroring the
  server's copyName including its 200-BYTE cap. The inline
  `${name} (copy)` both duplicated the suffix and, for a garden whose
  name was already at the cap, prefilled an over-long name that the
  server rejected with a 400. Unit-tested, including multi-byte
  truncation on a code-point boundary.

* test: drop a throwaway `_ = kept`.

Co-Authored-By: Claude Opus 4.8 (1M context) <[email protected]>

internal/store/objects.go

@@ -31,19 +31,30 @@ func scanObject(s scanner) (*domain.GardenObject, error) {
 	return &o, nil
 }
 
+// objectInsert inserts one garden_objects row and returns it. It is shared by
+// CreateObject and CopyGarden's in-transaction copy, with objectInsertArgs
+// supplying its parameters, so a column added to the table can't be wired into
+// one path and silently dropped from the other.
+const objectInsert = `INSERT INTO garden_objects
+	   (garden_id, kind, name, shape, points, x_cm, y_cm, width_cm, height_cm,
+	    rotation_deg, z_index, plantable, color, props, grid_size_cm, snap_to_grid, notes)
+	 VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)
+	 RETURNING ` + objectColumns
+
+// objectInsertArgs builds objectInsert's parameters, placing o in gardenID (which
+// is o's own garden on create, and the new garden when copying).
+func objectInsertArgs(gardenID int64, o *domain.GardenObject) []any {
+	return []any{
+		gardenID, o.Kind, o.Name, o.Shape, o.Points, o.XCM, o.YCM, o.WidthCM, o.HeightCM,
+		o.RotationDeg, o.ZIndex, boolToInt(o.Plantable), o.Color, o.Props,
+		o.GridSizeCM, boolToInt(o.SnapToGrid), o.Notes,
+	}
+}
+
 // CreateObject inserts a garden object (fields already validated by the service)
 // and returns the stored row.
 func (d *DB) CreateObject(ctx context.Context, o *domain.GardenObject) (*domain.GardenObject, error) {
-	created, err := scanObject(d.sql.QueryRowContext(ctx,
-		`INSERT INTO garden_objects
-		   (garden_id, kind, name, shape, points, x_cm, y_cm, width_cm, height_cm,
-		    rotation_deg, z_index, plantable, color, props, grid_size_cm, snap_to_grid, notes)
-		 VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)
-		 RETURNING `+objectColumns,
-		o.GardenID, o.Kind, o.Name, o.Shape, o.Points, o.XCM, o.YCM, o.WidthCM, o.HeightCM,
-		o.RotationDeg, o.ZIndex, boolToInt(o.Plantable), o.Color, o.Props,
-		o.GridSizeCM, boolToInt(o.SnapToGrid), o.Notes,
-	))
+	created, err := scanObject(d.sql.QueryRowContext(ctx, objectInsert, objectInsertArgs(o.GardenID, o)...))
 	if err != nil {
 		return nil, fmt.Errorf("store: insert object: %w", err)
 	}