fix(history): apply the plan_id filter the plan-history view sends #1404

parseHistoryFilters (internal/api/handler_history.go ~729) never reads the plan_id query parameter, but the frontend sends it: frontend/src/api/history.ts:22, and viewPlanHistory in frontend/src/history.ts ~282-294 passes { planId }. So the plan-history view shows, and with #1200 also totals, every in-scope purchase rather than just that plan's. Found in an independent review of #1200; it predates that PR.

Fix: parse plan_id (validate it as a UUID, 400 on garbage), apply it to the list query and to the summary totals, and add a handler test plus a jest test that the plan view's request returns only that plan's rows.