Address #127 review: quote the garden name, validate rectangles, require plantId

- The plan-name line of the system prompt interpolates the garden's name
  with %q like the rest of the prompt: any editor can rename a garden, and a
  name with a newline in it must not read as an instruction.
- fill_region refuses an inverted rectangle with its corners named, and a
  rectangle that misses the bed (or only touches its edge) is an error from
  the service rather than a successful fill of nothing.
- remove_plantings requires plantId; omitted it would remove plant 0 and
  report success.
- historyEntry.Undo → UndoOf (it holds the reverted change set's id).
- remove_planting's description names list_plantings as an id source.
- RemovePlanting takes the removal date itself; the dateless wrapper had no
  callers left.

Co-Authored-By: Claude Fable 5 <[email protected]>

internal/service/ops_test.go

@@ -797,4 +797,15 @@ func TestFillByRectangleAttributesSeed(t *testing.T) {
 			t.Errorf("empty rectangle %+v: err = %v, want ErrInvalidInput", r, err)
 		}
 	}
+	// A rectangle that misses the bed (it is 240 wide, so ±120) — or only
+	// touches its edge — is an error, not a successful fill of nothing.
+	for _, r := range []Region{{MinX: 200, MinY: -10, MaxX: 300, MaxY: 10}, {MinX: 120, MinY: -10, MaxX: 200, MaxY: 10}} {
+		if _, err := s.Fill(ctx, owner, bed.ID, FillSpec{Region: r, PlantID: garlic.ID}); !errors.Is(err, domain.ErrInvalidInput) {
+			t.Errorf("off-bed rectangle %+v: err = %v, want ErrInvalidInput", r, err)
+		}
+	}
+	// Partly outside is fine: the part inside gets planted.
+	if created, err := s.Fill(ctx, owner, bed.ID, FillSpec{Region: Region{MinX: 80, MinY: -10, MaxX: 300, MaxY: 10}, PlantID: garlic.ID}); err != nil || len(created) == 0 {
+		t.Errorf("overhanging rectangle: %d plops, %v; want some", len(created), err)
+	}
 }