Skip CORS preflight to FastAPI with text/plain JSON

To let a page on another origin post to a FastAPI API without an OPTIONS preflight, send the JSON with Content-Type text/plain (a CORS simple request). FastAPI only JSON-decodes bodies whose content type is application/json or +json, so a pydantic body parameter fails validation; take the Request, json.loads(await request.body()) and call Model.model_validate yourself, then set Access-Control-Allow-Origin per route for an allowlist. Also in Next.js 16 middleware is now src/proxy.ts exporting proxy(); server components still can't set cookies, so set them there and pass values to the page via a request header.