Fix session creation failing for every real browser

[MadsenDev]

The receiver's createSession sent content-type: application/json with no body. Fastify's default parser rejects that with FST_ERR_CTP_EMPTY_JSON_BODY and a 400 before the route runs, so the receiver could never create a session — the page showed "connection lost" and every retry failed instantly.

$ curl -X POST -H 'content-type: application/json' https://scanner.vardir.no/api/session
{"statusCode":400,"code":"FST_ERR_CTP_EMPTY_JSON_BODY", ...}

$ curl -X POST https://scanner.vardir.no/api/session
200

The bug predates the single-entry-point merge — createSession is unchanged since the first commit. It went unnoticed because a POST without the header takes a different path in Fastify and succeeds, and both the CI smoke test and the manual one used exactly that shape. Every check passed against an endpoint no browser could use.

Changes

• Receiver drops the header. The request carries no body, so declaring a JSON one was wrong.
• Relay tolerates an empty body on application/json rather than 400ing. No endpoint takes a request body, so a client setting the header out of habit shouldn't get an undiagnosable failure — the Phase 1 Android app is the obvious next caller to trip on it. Malformed JSON is still a 400.
• The regression test that was missing: a POST shaped exactly like the browser's, plus one asserting malformed JSON is still rejected.

64 tests pass (was 62). Verified in a built container: browser-shaped POST → 200, no-content-type POST → 200, malformed JSON → 400, full pair-and-scan → ALL PASS.

🤖 Generated with Claude Code