feat(plan): assertNotPastDate guard for write paths

src/services/plan.service.ts

@@ -245,3 +245,29 @@ export async function listPlanUsers(): Promise<PlanUser[]> {
     has_attendance_record: true,
   }));
 }
+
+/**
+ * Guard helper: returns { error, status } if `dateStr` is in the past
+ * and `force` is not set. Returns null if the date is editable.
+ *
+ * The comparison uses ISO date string equality. For past-date guard purposes
+ * any date strictly before today (in the local timezone per the project's
+ * TZ=Europe/Prague setting) is locked.
+ */
+export function assertNotPastDate(
+  dateStr: string,
+  force: boolean,
+): { error: string; status: number } | null {
+  if (force) return null;
+
+  const today = new Date();
+  const todayStr = today.toISOString().slice(0, 10);
+  if (dateStr < todayStr) {
+    return {
+      error:
+        "Nelze upravovat plán pro datum v minulosti. Pro nouzovou opravu použijte ?force=1.",
+      status: 403,
+    };
+  }
+  return null;
+}