Address second round of Gadfly findings on #89

- Rename fillRequest → objectFillRequest to match the package's
  <resource><Action>Request convention (objectCreateRequest, gardenCreateRequest…).
- Add the missing anonymous-clear permission case (401), mirroring anonymous fill.
- Reword the makeFillPlant comment to stop referencing external branch state,
  which won't make sense once merged — just note the consolidation follow-up.
- clearObject: send no body (undefined) rather than an empty {}, and validate
  the {cleared} response with a zod schema instead of a raw type cast.

Co-Authored-By: Claude Opus 4.8 (1M context) <[email protected]>
Claude-Session: https://claude.ai/code/session_01H3zbym8Doka2d7D48maSgZ

web/src/lib/objects.ts

@@ -328,6 +328,8 @@ export function useUpdatePlanting(gardenId: number) {
   })
 }
 
+const clearResultSchema = z.object({ cleared: z.number() })
+
 /** Clear a bed: soft-remove every active plop in an object (#82).
  *
  *  ONE request, and so ONE change set. This used to be a loop of PATCHes, which
@@ -341,8 +343,10 @@ export function useClearObject(gardenId: number) {
   const qc = useQueryClient()
   return useMutation({
     mutationFn: async (objectId: number): Promise<number> => {
-      const res = (await api.post(`/objects/${objectId}/clear`, {})) as { cleared?: number }
-      return res?.cleared ?? 0
+      // No body — clear takes none; passing undefined sends none rather than an
+      // empty {}. The response is just a count; validate it rather than cast.
+      const res = clearResultSchema.parse(await api.post(`/objects/${objectId}/clear`))
+      return res.cleared
     },
     onSettled: () => qc.invalidateQueries({ queryKey: fullKey(gardenId) }),
     onError: (err) => toast.error(objectErrorMessage(err, 'Could not clear the bed.')),