Address #127 review: quote the garden name, validate rectangles, require plantId

- The plan-name line of the system prompt interpolates the garden's name
  with %q like the rest of the prompt: any editor can rename a garden, and a
  name with a newline in it must not read as an instruction.
- fill_region refuses an inverted rectangle with its corners named, and a
  rectangle that misses the bed (or only touches its edge) is an error from
  the service rather than a successful fill of nothing.
- remove_plantings requires plantId; omitted it would remove plant 0 and
  report success.
- historyEntry.Undo → UndoOf (it holds the reverted change set's id).
- remove_planting's description names list_plantings as an id source.
- RemovePlanting takes the removal date itself; the dateless wrapper had no
  callers left.

Co-Authored-By: Claude Fable 5 <[email protected]>

internal/service/plantings.go

@@ -186,18 +186,12 @@ func (s *Service) UpdatePlanting(ctx context.Context, actorID, plantingID int64,
 }
 
 // RemovePlanting soft-removes a single plop — the one-plop counterpart to
-// ClearObject. It stamps removed_at from the service clock (s.now()), the same
-// UTC day ClearObject and the fill path default to; RemovePlantingOn is the
-// form for a caller that knows the gardener's local day. Both delegate to
-// UpdatePlanting for the editor-role check, version guard and history record.
-func (s *Service) RemovePlanting(ctx context.Context, actorID, plantingID, version int64) (*domain.Planting, error) {
-	return s.RemovePlantingOn(ctx, actorID, plantingID, version, nil)
-}
-
-// RemovePlantingOn is RemovePlanting with the removal date supplied (YYYY-MM-DD)
-// by a caller that knows the person's local day. nil keeps the service clock's
-// UTC today.
-func (s *Service) RemovePlantingOn(ctx context.Context, actorID, plantingID, version int64, removedAt *string) (*domain.Planting, error) {
+// ClearObject, used by the agent's remove_planting tool. removedAt (YYYY-MM-DD)
+// is the day the caller knows it happened — the gardener's local day; nil
+// stamps the service clock's UTC today, the same default ClearObject and the
+// fill path use. Delegates to UpdatePlanting for the editor-role check, version
+// guard and history record.
+func (s *Service) RemovePlanting(ctx context.Context, actorID, plantingID, version int64, removedAt *string) (*domain.Planting, error) {
 	if !validDatePtr(removedAt) {
 		return nil, fmt.Errorf("%w: removedAt must be a YYYY-MM-DD date", domain.ErrInvalidInput)
 	}