Reports are taken only as application/json (closes #126)

A page on another origin can POST text/plain or a form without a CORS
preflight, so its visitors' browsers could store reports although the
server sends no CORS headers. decodeJSON now refuses a request whose
Content-Type is not application/json (parameters such as charset
allowed), and the report handler answers it 415 with the usual error
body, storing nothing. A JSON POST waits for the preflight, which only
an origin in CORS_ALLOWED_ORIGINS passes; the page already sends
application/json.

Model: opus-5-5

TODO.md

@@ -22,6 +22,16 @@ Decide whether the repo moves to the layout `REPO_POLICIES.md` gives, with
 
 # Completed Steps
 
+- 2026-10-14: `POST /api/v1/reports` takes only a report sent with
+  `Content-Type: application/json`, parameters such as `charset` allowed, and
+  refuses any other with 415 and the usual error body, storing nothing
+  ([#126](https://git.eeqj.de/sneak/netwatch/issues/126)). A page on another
+  origin can send a `text/plain` POST without a CORS preflight, so any site
+  could make its visitors' browsers store reports; a JSON POST waits for the
+  preflight, which only an origin in `CORS_ALLOWED_ORIGINS` passes. The page
+  already sent `application/json`. A test posts a report as `text/plain`, with
+  no `Content-Type`, and as `application/json` with and without a charset, and
+  checks which are stored
 - 2026-10-07: the files shared from `sneak/prompts` are its copies at commit
   `dd4027b` ([#113](https://git.eeqj.de/sneak/netwatch/issues/113)), with this
   repository's own entries after the shared content in `.gitignore`,