Address Gadfly review on #10: clearable color/props, column lists, dedup

Fixes from the PR #28 adversarial review (considered; not graded).

Correctness / API
- PATCH /objects/:id can now clear nullable color/props back to NULL: the
  request takes them as json.RawMessage, and ObjectPatch carries an explicit
  Set flag so an explicit `null` (clear) is distinguished from an absent
  field (unchanged) — the strongest cross-model finding (6 hits). New test.

Maintainability
- store/plantings.go + plants.go use explicit qualified column lists
  (qualifyColumns helper) instead of SELECT *, matching gardens/objects and
  surviving a future column add.
- Consolidated objectKinds + plantableByDefault into one kind→traits map.
- objectForRole factors the fetch-then-authorize shared by UpdateObject and
  DeleteObject; dropped the redundant kind check in CreateObject
  (finalizeObject is the single validation point).
- Request→service mapping via toInput()/toPatch() methods (matches gardens).
- Renamed handler gardenFull → getGardenFull (verbNoun); test helper
  decodeGarden → decodeMap; generic bind-error messages.

Co-Authored-By: Claude Opus 4.8 (1M context) <[email protected]>
Claude-Session: https://claude.ai/code/session_01JdQpdYYsTgtkJBxbcpAszi

internal/api/objects_test.go

@@ -16,7 +16,7 @@ func createGardenAPI(t *testing.T, r *gin.Engine, cookie *http.Cookie, name stri
 	if w.Code != http.StatusCreated {
 		t.Fatalf("create garden: status %d, body %s", w.Code, w.Body.String())
 	}
-	return int64(decodeGarden(t, w.Body.Bytes())["id"].(float64))
+	return int64(decodeMap(t, w.Body.Bytes())["id"].(float64))
 }
 
 func objectPath(id int64) string { return "/api/v1/objects/" + strconv.FormatInt(id, 10) }
@@ -36,7 +36,7 @@ func TestObjectCRUDAndFull(t *testing.T) {
 	if w.Code != http.StatusCreated {
 		t.Fatalf("create object: status %d, body %s", w.Code, w.Body.String())
 	}
-	obj := decodeGarden(t, w.Body.Bytes())
+	obj := decodeMap(t, w.Body.Bytes())
 	oid := int64(obj["id"].(float64))
 	if obj["plantable"].(bool) != true {
 		t.Error("bed should default plantable=true")
@@ -68,7 +68,7 @@ func TestObjectCRUDAndFull(t *testing.T) {
 	if w.Code != http.StatusOK {
 		t.Fatalf("patch: status %d, body %s", w.Code, w.Body.String())
 	}
-	patched := decodeGarden(t, w.Body.Bytes())
+	patched := decodeMap(t, w.Body.Bytes())
 	if patched["xCm"].(float64) != 500 || patched["version"].(float64) != 2 {
 		t.Errorf("patch didn't apply/bump: %+v", patched)
 	}
@@ -90,7 +90,7 @@ func TestObjectVersionConflict(t *testing.T) {
 	gid := createGardenAPI(t, r, cookie, "Yard")
 	w := doJSON(t, r, http.MethodPost, objectsPath(gid),
 		map[string]any{"kind": "bed", "xCm": 300, "yCm": 300, "widthCm": 100, "heightCm": 100}, cookie)
-	oid := int64(decodeGarden(t, w.Body.Bytes())["id"].(float64))
+	oid := int64(decodeMap(t, w.Body.Bytes())["id"].(float64))
 
 	body := map[string]any{"xCm": 400, "version": 1}
 	if w := doJSON(t, r, http.MethodPatch, objectPath(oid), body, cookie); w.Code != http.StatusOK {
@@ -117,7 +117,7 @@ func TestObjectCrossUserIsNotFound(t *testing.T) {
 	gid := createGardenAPI(t, r, alice, "Alice's")
 	w := doJSON(t, r, http.MethodPost, objectsPath(gid),
 		map[string]any{"kind": "bed", "xCm": 300, "yCm": 300, "widthCm": 100, "heightCm": 100}, alice)
-	oid := int64(decodeGarden(t, w.Body.Bytes())["id"].(float64))
+	oid := int64(decodeMap(t, w.Body.Bytes())["id"].(float64))
 
 	// Bob can't see the garden or its objects — all 404.
 	if w := doJSON(t, r, http.MethodGet, fullPath(gid), nil, bob); w.Code != http.StatusNotFound {
@@ -134,6 +134,42 @@ func TestObjectCrossUserIsNotFound(t *testing.T) {
 	}
 }
 
+func TestObjectPatchClearsColorAndProps(t *testing.T) {
+	r := authEngine(t, localCfg())
+	cookie := registerAndCookie(t, r, "[email protected]")
+	gid := createGardenAPI(t, r, cookie, "Yard")
+
+	// Create with a color override and props.
+	w := doJSON(t, r, http.MethodPost, objectsPath(gid),
+		map[string]any{"kind": "bed", "xCm": 300, "yCm": 300, "widthCm": 100, "heightCm": 100,
+			"color": "#3f8f4f", "props": map[string]any{"heightCm": 40}}, cookie)
+	obj := decodeMap(t, w.Body.Bytes())
+	oid := int64(obj["id"].(float64))
+	if obj["color"].(string) != "#3f8f4f" {
+		t.Fatalf("color not set on create: %v", obj["color"])
+	}
+
+	// PATCH color:null props:null clears both back to absent (omitempty).
+	w = doJSON(t, r, http.MethodPatch, objectPath(oid),
+		map[string]any{"color": nil, "props": nil, "version": 1}, cookie)
+	if w.Code != http.StatusOK {
+		t.Fatalf("clear patch: status %d, body %s", w.Code, w.Body.String())
+	}
+	cleared := decodeMap(t, w.Body.Bytes())
+	if _, present := cleared["color"]; present {
+		t.Errorf("color should be cleared (absent), got %v", cleared["color"])
+	}
+	if _, present := cleared["props"]; present {
+		t.Errorf("props should be cleared (absent), got %v", cleared["props"])
+	}
+
+	// A patch that omits color leaves it unchanged (still absent here).
+	w = doJSON(t, r, http.MethodPatch, objectPath(oid), map[string]any{"xCm": 350, "version": 2}, cookie)
+	if w.Code != http.StatusOK {
+		t.Fatalf("move patch: %d", w.Code)
+	}
+}
+
 func TestObjectValidationRejects(t *testing.T) {
 	r := authEngine(t, localCfg())
 	cookie := registerAndCookie(t, r, "[email protected]")
@@ -154,7 +190,7 @@ func TestObjectValidationRejects(t *testing.T) {
 	if w.Code != http.StatusCreated {
 		t.Fatalf("props create = %d, body %s", w.Code, w.Body.String())
 	}
-	if props, _ := decodeGarden(t, w.Body.Bytes())["props"].(string); props == "" {
+	if props, _ := decodeMap(t, w.Body.Bytes())["props"].(string); props == "" {
 		t.Error("props should be stored and returned as a JSON string")
 	}
 }