fix(entries): reject create/update of intervals in the future

- Add ErrFutureDay sentinel error
- CreateInterval: rejects if startDayKey > todayKey (400)
- Update: rejects if new start_time moves entry to a future day (400)
- Handler maps ErrFutureDay → 400 Bad Request for both endpoints
- Add TestCreateIntervalRejectsFutureDay
- Add TestUpdateRejectsMoveToFutureDay
- UI already gates this via dayCapabilities (canAddInterval=false,
  canEditEntries=false for future days), but server now enforces it too

internal/handler/entry_handler.go

@@ -52,6 +52,8 @@ func (h *EntryHandler) CreateInterval(w http.ResponseWriter, r *http.Request) {
 			writeError(w, http.StatusUnprocessableEntity, err.Error())
 		case errors.Is(err, service.ErrDayAlreadyClosed):
 			writeError(w, http.StatusConflict, err.Error())
+		case errors.Is(err, service.ErrFutureDay):
+			writeError(w, http.StatusBadRequest, err.Error())
 		default:
 			writeError(w, http.StatusInternalServerError, err.Error())
 		}
@@ -145,6 +147,8 @@ func (h *EntryHandler) Update(w http.ResponseWriter, r *http.Request) {
 			writeError(w, http.StatusNotFound, err.Error())
 		case errors.Is(err, service.ErrCrossesMidnight):
 			writeError(w, http.StatusUnprocessableEntity, err.Error())
+		case errors.Is(err, service.ErrFutureDay):
+			writeError(w, http.StatusBadRequest, err.Error())
 		default:
 			writeError(w, http.StatusInternalServerError, err.Error())
 		}