fix(server): require JSON content types for mutations

[mldangelo-oai]

Summary

The findings mutation endpoints parsed request bodies without checking their declared media type. Both endpoints now require Content-Type: application/json and reject other or missing types with HTTP 400 invalid_request before parsing, embedding, or storage.

Changes

• Check the MIME type in the shared JSON reader for POST /v1/bulk/findings and POST /v1/dedupe-groups.
• Accept case variations and charset parameters; drain rejected request bodies using the existing error response shape.
• Add synthetic regressions for rejected types, unchanged stored data and embedding calls, and accepted JSON requests; document the HTTP requirement.

Testing

• The findings server, authentication, and configuration focused suites passed: 212 tests, zero failures.
• On the alpha.14 main merge, full SDK orders passed with seed 12345 and a random seed: each had 3,576 passes, 53 skips, zero failures, and 69,655 assertions across 160 files.
• After the subsequent main merge to 1345ea3f, all six artifact-export regressions and 212 preview/rank regressions passed. The findings implementation and its tests were unchanged by that merge.
• At the final head: SDK types, formatting, build:ci, plugin generation, Ruff lint/format, portable plugin compatibility, and all nine checker tests passed.
• Three fresh native review passes and independent verification passed against the final main base; git diff --check passed.

Risk and rollout

Clients sending JSON without a content type, or using another media type, must send Content-Type: application/json before rollout. Existing JSON clients and documented examples use this header. Case variations and charset parameters remain supported. This changes the HTTP body-format requirement; it adds no public CLI syntax or authentication mechanism. Follow the existing local-service and authenticated proxy deployment guidance.

Public disclosure review

• No customer, partner, prospect, or user identities, data, or identifying details are included.
• No credentials, personal data, private source, scan findings, or nonpublic links or tickets are included.
• I reviewed the branch name, title, description, commits, changes, comments, logs, screenshots, attachments, and links for public disclosure.

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-10-05T15:39:08.758677Z	a2d643d	New commits
🔒 Security Review	✅ Completed 2026-10-05T15:41:18.247081Z	a2d643d	New commits

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[alandelong-oai]

Reviewed the full contribution at a2d643d7752d1487f8d7a8106d4c44dcb94fa9f5 with selected base 1345ea3fa48021ef54ecc2dcc948fde43fec8d0c, including changed tests and touched context, using three independent reviews followed by root synthesis.

No supported introduced finding.

Static source review; tests were inspected but not executed. CI, mergeability and integration are separate.