Link planned days to their wish, fix the age-4 cap, drop the planning goal

Three changes that together unblock treating a calendar period as one
editable object.

Migration 008 adds `planned_leave_day.wish_id` (nullable, ON DELETE SET NULL)
so a persisted day knows which `leave_wish` produced it, `is_pinned` to mark a
day the user hand-edited, and `leave_wish.target_days` so a period drawn on a
calendar need not be a whole number of weeks. Apply-time identity still keys on
day_type/is_dubbeldag only, so a wish_id-only difference is a metadata update
rather than a collision.

The age-4 savable ceiling was applying the per-child figure of 96 to each
parent's pool, modelling a two-parent family as able to save 192 days past the
child's fourth birthday. `resolve_age4_savable_cap` is now the single place
that decides 48 (couple with two parents) versus 96 (everyone else), and both
AnalyticsService and the allocator read it.

Migration 009 drops `workspace.planning_goal` and `leave_wish.goal_override`.
The allocator's tier-3 policy collapses to one rule; `salary_type` still
branches, since that reflects what a vacation day actually costs a parent
rather than a user preference.

backend/app/services/planning_service.py

@@ -32,8 +32,12 @@ class ProposedDayInput:
     Deliberately a plain domain dataclass (not a Pydantic model) so the
     service stays independent of the wire schema in `app.models.plan` — the
     router is responsible for that translation. Shape mirrors
-    `allocation_service.ProposedDay` minus the explain-only `wish_id`/`reason`
-    fields, which carry no persistence meaning.
+    `allocation_service.ProposedDay` minus the explain-only `reason` field,
+    which carries no persistence meaning. `wish_id` DOES carry persistence
+    meaning (unlike `reason`): it links the persisted `planned_leave_day` row
+    back to the `LeaveWish` that produced it (nullable — ad-hoc/legacy days
+    have none), which is what lets the UI later treat a multi-day band as one
+    editable period instead of one day at a time.
     """
 
     date: date
@@ -41,6 +45,9 @@ class ProposedDayInput:
     child_id: UUID
     day_type: str
     is_dubbeldag: bool = False
+    wish_id: UUID | None = None
+    # True once the user hand-edits this day; see `PlannedLeaveDay.is_pinned`.
+    is_pinned: bool = False
 
 
 @dataclass(frozen=True)
@@ -99,6 +106,8 @@ class PlanningService:
         date: date,
         day_type: str,
         is_dubbeldag: bool = False,
+        wish_id: UUID | None = None,
+        is_pinned: bool = False,
     ) -> PlannedLeaveDay:
         """Add a planned leave day.
 
@@ -131,6 +140,8 @@ class PlanningService:
             date=date,
             day_type=day_type,
             is_dubbeldag=is_dubbeldag,
+            wish_id=wish_id,
+            is_pinned=is_pinned,
             created_at=now,
             updated_at=now,
         )
@@ -178,6 +189,8 @@ class PlanningService:
         planned_leave_day_id: UUID,
         day_type: str | None = None,
         is_dubbeldag: bool | None = None,
+        wish_id: UUID | None = None,
+        is_pinned: bool | None = None,
     ) -> PlannedLeaveDay:
         """Update a planned day (partial update)."""
         entity = await self._repo.get_by_id(planned_leave_day_id)
@@ -188,6 +201,10 @@ class PlanningService:
             entity.day_type = day_type
         if is_dubbeldag is not None:
             entity.is_dubbeldag = is_dubbeldag
+        if wish_id is not None:
+            entity.wish_id = wish_id
+        if is_pinned is not None:
+            entity.is_pinned = is_pinned
 
         return await self._repo.update(planned_leave_day_id, entity)
 
@@ -217,10 +234,15 @@ class PlanningService:
 
         Idempotent per (workspace, child, parent, date): re-applying an
         identical batch creates nothing and is reported as all
-        `skipped_identical_count`. A date already planned *differently* is a
-        collision — by default the whole batch is refused and nothing is
-        written; pass `replace=True` to overwrite those specific collisions
-        (every other collision-free day in the batch is written too).
+        `skipped_identical_count`. Identity here is `day_type`/`is_dubbeldag`
+        only — a day whose only difference from what's persisted is
+        `wish_id`/`is_pinned` still counts as `skipped_identical_count`, but
+        is quietly written as a metadata-only update rather than left stale;
+        it is never treated as a collision. A date already planned
+        *differently* (in `day_type`/`is_dubbeldag`) is a collision — by
+        default the whole batch is refused and nothing is written; pass
+        `replace=True` to overwrite those specific collisions (every other
+        collision-free day in the batch is written too).
 
         Validates the entire batch up front (day types, per-day dubbeldagar
         window, batch-wide dubbeldagar quota, child eligibility window,
@@ -247,7 +269,13 @@ class PlanningService:
         for d in persistable:
             key = (d.child_id, d.parent_personal_data_uuid, d.date)
             prior = deduped.get(key)
-            if prior is not None and prior != d:
+            # Conflict is keyed on day_type/is_dubbeldag only — the same
+            # (child, parent, date) appearing twice with different `wish_id`/
+            # `is_pinned` is not a genuine conflict (attribution metadata,
+            # not the persisted day's identity); the later entry simply wins.
+            if prior is not None and (
+                prior.day_type != d.day_type or prior.is_dubbeldag != d.is_dubbeldag
+            ):
                 structural_errors.append(
                     Rejection(
                         message_key="planApply.rejection.conflictingDuplicate",
@@ -285,6 +313,7 @@ class PlanningService:
 
         to_create: list[ProposedDayInput] = []
         to_replace: list[tuple[PlannedLeaveDay, ProposedDayInput]] = []
+        to_update_metadata: list[tuple[PlannedLeaveDay, ProposedDayInput]] = []
         collisions: list[DayCollision] = []
         skipped_identical_count = 0
 
@@ -296,6 +325,14 @@ class PlanningService:
                 continue
             if existing.day_type == d.day_type and existing.is_dubbeldag == d.is_dubbeldag:
                 skipped_identical_count += 1
+                # Identical-vs-collision is (and stays) keyed on
+                # day_type/is_dubbeldag only. A row whose only difference is
+                # `wish_id`/`is_pinned` is never a collision requiring
+                # `replace=True` — it's a plain metadata update, written
+                # below without touching `skipped_identical_count` or
+                # `collisions`.
+                if existing.wish_id != d.wish_id or existing.is_pinned != d.is_pinned:
+                    to_update_metadata.append((existing, d))
                 continue
             collisions.append(
                 DayCollision(
@@ -322,7 +359,7 @@ class PlanningService:
             )
 
         pending = to_create + [new for _, new in to_replace]
-        if not pending:
+        if not pending and not to_update_metadata:
             # Nothing left to write — either an empty batch or a fully
             # idempotent re-apply.
             return PlanApplyResult(
@@ -355,11 +392,18 @@ class PlanningService:
                 date=d.date,
                 day_type=d.day_type,
                 is_dubbeldag=d.is_dubbeldag,
+                wish_id=d.wish_id,
+                is_pinned=d.is_pinned,
                 created_at=now,
                 updated_at=now,
             )
             created.append(await self._repo.create(entity))
 
+        for existing, d in to_update_metadata:
+            existing.wish_id = d.wish_id
+            existing.is_pinned = d.is_pinned
+            await self._repo.update(existing.id, existing)
+
         return PlanApplyResult(
             accepted=True,
             created=created,