Address Gadfly review on #10: clearable color/props, column lists, dedup

Fixes from the PR #28 adversarial review (considered; not graded).

Correctness / API
- PATCH /objects/:id can now clear nullable color/props back to NULL: the
  request takes them as json.RawMessage, and ObjectPatch carries an explicit
  Set flag so an explicit `null` (clear) is distinguished from an absent
  field (unchanged) — the strongest cross-model finding (6 hits). New test.

Maintainability
- store/plantings.go + plants.go use explicit qualified column lists
  (qualifyColumns helper) instead of SELECT *, matching gardens/objects and
  surviving a future column add.
- Consolidated objectKinds + plantableByDefault into one kind→traits map.
- objectForRole factors the fetch-then-authorize shared by UpdateObject and
  DeleteObject; dropped the redundant kind check in CreateObject
  (finalizeObject is the single validation point).
- Request→service mapping via toInput()/toPatch() methods (matches gardens).
- Renamed handler gardenFull → getGardenFull (verbNoun); test helper
  decodeGarden → decodeMap; generic bind-error messages.

Co-Authored-By: Claude Opus 4.8 (1M context) <[email protected]>
Claude-Session: https://claude.ai/code/session_01JdQpdYYsTgtkJBxbcpAszi

internal/api/gardens_test.go

@@ -20,13 +20,14 @@ func registerAndCookie(t *testing.T, r *gin.Engine, email string) *http.Cookie {
 	return sessionCookieFrom(t, w)
 }
 
-func decodeGarden(t *testing.T, body []byte) map[string]any {
+// decodeMap unmarshals any JSON object response into a generic map.
+func decodeMap(t *testing.T, body []byte) map[string]any {
 	t.Helper()
-	var g map[string]any
-	if err := json.Unmarshal(body, &g); err != nil {
-		t.Fatalf("decode garden: %v (body %s)", err, body)
+	var m map[string]any
+	if err := json.Unmarshal(body, &m); err != nil {
+		t.Fatalf("decode json object: %v (body %s)", err, body)
 	}
-	return g
+	return m
 }
 
 func TestGardenCRUDFlow(t *testing.T) {
@@ -38,7 +39,7 @@ func TestGardenCRUDFlow(t *testing.T) {
 	if w.Code != http.StatusCreated {
 		t.Fatalf("create status = %d, body %s", w.Code, w.Body.String())
 	}
-	created := decodeGarden(t, w.Body.Bytes())
+	created := decodeMap(t, w.Body.Bytes())
 	id := int64(created["id"].(float64))
 	if created["widthCm"].(float64) != 1000 || created["unitPref"].(string) != "metric" {
 		t.Errorf("defaults not applied: %+v", created)
@@ -69,7 +70,7 @@ func TestGardenCRUDFlow(t *testing.T) {
 	if w.Code != http.StatusOK {
 		t.Fatalf("patch status = %d, body %s", w.Code, w.Body.String())
 	}
-	patched := decodeGarden(t, w.Body.Bytes())
+	patched := decodeMap(t, w.Body.Bytes())
 	if patched["name"].(string) != "Front" || patched["version"].(float64) != 2 {
 		t.Errorf("patch didn't persist/bump: %+v", patched)
 	}
@@ -90,7 +91,7 @@ func TestGardenVersionConflictEnvelope(t *testing.T) {
 	cookie := registerAndCookie(t, r, "[email protected]")
 
 	w := doJSON(t, r, http.MethodPost, "/api/v1/gardens", map[string]any{"name": "Yard"}, cookie)
-	id := int64(decodeGarden(t, w.Body.Bytes())["id"].(float64))
+	id := int64(decodeMap(t, w.Body.Bytes())["id"].(float64))
 
 	body := map[string]any{"name": "Yard2", "widthCm": 1000, "heightCm": 1000, "unitPref": "metric", "version": 1}
 	// First patch at version 1 succeeds (→ version 2).
@@ -123,7 +124,7 @@ func TestGardenCrossUserIsNotFound(t *testing.T) {
 	bob := registerAndCookie(t, r, "[email protected]")
 
 	w := doJSON(t, r, http.MethodPost, "/api/v1/gardens", map[string]any{"name": "Alice's"}, alice)
-	id := int64(decodeGarden(t, w.Body.Bytes())["id"].(float64))
+	id := int64(decodeMap(t, w.Body.Bytes())["id"].(float64))
 
 	// Bob sees a 404 (existence masked), not a 403.
 	if w := doJSON(t, r, http.MethodGet, gardenPath(id), nil, bob); w.Code != http.StatusNotFound {
@@ -166,7 +167,7 @@ func TestGardenUpdateRejectsBadVersion(t *testing.T) {
 	r := authEngine(t, localCfg())
 	cookie := registerAndCookie(t, r, "[email protected]")
 	w := doJSON(t, r, http.MethodPost, "/api/v1/gardens", map[string]any{"name": "Yard"}, cookie)
-	id := int64(decodeGarden(t, w.Body.Bytes())["id"].(float64))
+	id := int64(decodeMap(t, w.Body.Bytes())["id"].(float64))
 
 	// A negative (or zero) version is invalid input (400), not a version conflict.
 	for _, v := range []int{0, -1} {