Address #127 review: quote the garden name, validate rectangles, require plantId

- The plan-name line of the system prompt interpolates the garden's name
  with %q like the rest of the prompt: any editor can rename a garden, and a
  name with a newline in it must not read as an instruction.
- fill_region refuses an inverted rectangle with its corners named, and a
  rectangle that misses the bed (or only touches its edge) is an error from
  the service rather than a successful fill of nothing.
- remove_plantings requires plantId; omitted it would remove plant 0 and
  report success.
- historyEntry.Undo → UndoOf (it holds the reverted change set's id).
- remove_planting's description names list_plantings as an id source.
- RemovePlanting takes the removal date itself; the dateless wrapper had no
  callers left.

Co-Authored-By: Claude Fable 5 <[email protected]>

internal/service/ops.go

@@ -276,6 +276,14 @@ func (s *Service) fillLoaded(ctx context.Context, actorID int64, o *domain.Garde
 	}
 
 	region = region.clampTo(o.WidthCM/2, o.HeightCM/2)
+	if region.MaxX <= region.MinX || region.MaxY <= region.MinY {
+		// An explicit rectangle that misses the object, or only touches its edge.
+		// Planting nothing and reporting success would read as "done" to a caller
+		// that aimed at the wrong coordinates (typically the agent mixing up the
+		// garden frame and the object's local one) — and a rectangle clamped to a
+		// line would get hexCenters' one-plop-in-the-middle rule, on the edge.
+		return nil, fmt.Errorf("%w: the region lies outside the object", domain.ErrInvalidInput)
+	}
 	centers, total := hexCenters(region, radius, edgeInset(radius, spacing, layout), maxFillPlops)
 	if total > maxFillPlops {
 		return nil, domain.ErrInvalidInput // region too large for this spacing; ask for less