Address second round of Gadfly findings on #89

- Rename fillRequest → objectFillRequest to match the package's
  <resource><Action>Request convention (objectCreateRequest, gardenCreateRequest…).
- Add the missing anonymous-clear permission case (401), mirroring anonymous fill.
- Reword the makeFillPlant comment to stop referencing external branch state,
  which won't make sense once merged — just note the consolidation follow-up.
- clearObject: send no body (undefined) rather than an empty {}, and validate
  the {cleared} response with a zod schema instead of a raw type cast.

Co-Authored-By: Claude Opus 4.8 (1M context) <[email protected]>
Claude-Session: https://claude.ai/code/session_01H3zbym8Doka2d7D48maSgZ

internal/api/ops_test.go

@@ -10,11 +10,10 @@ import (
 func fillPath(id int64) string  { return objectPath(id) + "/fill" }
 func clearPath(id int64) string { return objectPath(id) + "/clear" }
 
-// makeFillPlant creates a custom plant and returns its id.
-//
-// Deliberately named apart from the seed-lot tests' helper: that one arrives on
-// a separate branch, and two files declaring the same helper would collide on
-// whichever merged second.
+// makeFillPlant creates a custom plant and returns its id. (A near-identical
+// createPlantAPI landed alongside the seed-lot tests; consolidating the two into
+// one shared helper is a fine follow-up, kept separate here only to avoid a
+// merge collision on the shared symbol.)
 func makeFillPlant(t *testing.T, r *gin.Engine, cookie *http.Cookie, name string, spacing float64) int64 {
 	t.Helper()
 	w := doJSON(t, r, http.MethodPost, "/api/v1/plants", map[string]any{
@@ -221,4 +220,7 @@ func TestFillClearPermissionsAPI(t *testing.T) {
 	if w := doJSON(t, r, http.MethodPost, fillPath(objID), fillBody, nil); w.Code != http.StatusUnauthorized {
 		t.Errorf("anonymous fill = %d, want 401", w.Code)
 	}
+	if w := doJSON(t, r, http.MethodPost, clearPath(objID), nil, nil); w.Code != http.StatusUnauthorized {
+		t.Errorf("anonymous clear = %d, want 401", w.Code)
+	}
 }