Address second round of Gadfly findings on #89

- Rename fillRequest → objectFillRequest to match the package's
  <resource><Action>Request convention (objectCreateRequest, gardenCreateRequest…).
- Add the missing anonymous-clear permission case (401), mirroring anonymous fill.
- Reword the makeFillPlant comment to stop referencing external branch state,
  which won't make sense once merged — just note the consolidation follow-up.
- clearObject: send no body (undefined) rather than an empty {}, and validate
  the {cleared} response with a zod schema instead of a raw type cast.

Co-Authored-By: Claude Opus 4.8 (1M context) <[email protected]>
Claude-Session: https://claude.ai/code/session_01H3zbym8Doka2d7D48maSgZ

internal/api/ops.go

@@ -37,14 +37,14 @@ func (r fillRect) degenerate() bool {
 	return r.MaxX <= r.MinX || r.MaxY <= r.MinY
 }
 
-// fillRequest is the body for POST /objects/:id/fill.
+// objectFillRequest is the body for POST /objects/:id/fill.
 //
 // A region is given EITHER by compass name ("ne", "south half", "all") or as an
 // explicit rect in the object's local frame. The named form is what a person
 // means and what the agent uses; the rect is for a future drag-a-box affordance.
 // Exactly one must be supplied — accepting both and silently preferring one
 // would make a client bug look like a geometry bug.
-type fillRequest struct {
+type objectFillRequest struct {
 	PlantID int64     `json:"plantId" binding:"required"`
 	Region  string    `json:"region"`
 	Rect    *fillRect `json:"rect"`
@@ -58,7 +58,7 @@ func (h *handlers) fillObject(c *gin.Context) {
 	if !ok {
 		return
 	}
-	var req fillRequest
+	var req objectFillRequest
 	if err := c.ShouldBindJSON(&req); err != nil {
 		writeAPIError(c, http.StatusBadRequest, "INVALID_INPUT", "a plantId and a region are required")
 		return

internal/api/ops_test.go

@@ -10,11 +10,10 @@ import (
 func fillPath(id int64) string  { return objectPath(id) + "/fill" }
 func clearPath(id int64) string { return objectPath(id) + "/clear" }
 
-// makeFillPlant creates a custom plant and returns its id.
-//
-// Deliberately named apart from the seed-lot tests' helper: that one arrives on
-// a separate branch, and two files declaring the same helper would collide on
-// whichever merged second.
+// makeFillPlant creates a custom plant and returns its id. (A near-identical
+// createPlantAPI landed alongside the seed-lot tests; consolidating the two into
+// one shared helper is a fine follow-up, kept separate here only to avoid a
+// merge collision on the shared symbol.)
 func makeFillPlant(t *testing.T, r *gin.Engine, cookie *http.Cookie, name string, spacing float64) int64 {
 	t.Helper()
 	w := doJSON(t, r, http.MethodPost, "/api/v1/plants", map[string]any{
@@ -221,4 +220,7 @@ func TestFillClearPermissionsAPI(t *testing.T) {
 	if w := doJSON(t, r, http.MethodPost, fillPath(objID), fillBody, nil); w.Code != http.StatusUnauthorized {
 		t.Errorf("anonymous fill = %d, want 401", w.Code)
 	}
+	if w := doJSON(t, r, http.MethodPost, clearPath(objID), nil, nil); w.Code != http.StatusUnauthorized {
+		t.Errorf("anonymous clear = %d, want 401", w.Code)
+	}
 }