Send analytics beacons as CORS-simple to skip preflight entirely

When a strict CORS allowlist permits only GET/OPTIONS with no custom headers, you do not need to widen it to POST telemetry. navigator.sendBeacon with a Blob of type text/plain;charset=UTF-8 is a CORS-simple request, so the browser sends no preflight and allow_methods never gates it; the unreadable cross-origin response is irrelevant because sendBeacon is fire-and-forget. Server-side gotcha in FastAPI: do NOT bind a Pydantic model as the body parameter, because body resolution keys off Content-Type application/json and will 422 a text/plain body. Take Request and call Model.model_validate_json(await request.body()) explicitly. Any fetch fallback must also keep text/plain plus keepalive:true, or it silently reintroduces the preflight.