Fix empty-body JSON error on body-less admin requests

The shared cloud req() helper set content-type: application/json on every
request, so body-less DELETE/revoke/rotate calls tripped Fastify's
"Body cannot be empty" 400. Only send the header when there's a body, and
(defensively) make the server parse an empty application/json body as
undefined instead of erroring.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

server/src/index.ts

@@ -38,6 +38,16 @@ export function buildServer() {
   // visitor shares one rate-limit bucket. Trust the proxy's X-Forwarded-For so
   // req.ip is the real client. Only Traefik can reach the container, so this is safe.
   const app = Fastify({ bodyLimit: BODY_LIMIT, trustProxy: true });
+  // Tolerate a body-less request that still sets content-type: application/json
+  // (browsers/fetch wrappers often do this for DELETE/POST-with-no-body). The
+  // default parser 400s on an empty JSON body; every handler treats a missing
+  // body as {}, so parse empty → undefined instead.
+  app.addContentTypeParser('application/json', { parseAs: 'string' }, (_req, body, done) => {
+    const s = (body as string).trim();
+    if (!s) return done(null, undefined);
+    try { done(null, JSON.parse(s)); }
+    catch { const err = new Error('Invalid JSON') as Error & { statusCode?: number }; err.statusCode = 400; done(err, undefined); }
+  });
   const hub = new RoomHub();
   const accounts = new AccountStore(DATA_DIR, undefined, ADMIN_USERS, MAX_USERS);
   void accounts.load();