testing/cross_backend/simple_request.ts

Cross-backend parity suite for refusing CORS simple requests.

A POST with no Content-Type, or a text/plain / form / multipart one, is what a browser sends cross-origin without a preflight — carrying the session cookie when the page is same-site, which any other localhost port is. Every spine's JSON routes require application/json and refuse anything else with a flat 415 {error: 'unsupported_content_type'} before reading a credential or the body: the TS spine per route (apply_route_specs, every POST that isn't raw_body), the Rust spine in each JSON handler. The cases carry an allowed Origin and, where it matters, the keeper's session — the exact shape of a same-site page's forged request, which the origin allowlist alone admits when it's a wildcard — and a refused request must leave that session untouched.

Runs both legs via the shared setup_test protocol: in-process (auth/simple_request_parity.db.test.ts) and cross-process (cross_backend/simple_request.cross.test.ts). Every spine has the gate, so the suite is ungated.