Receive a Content-Security-Policy violation report

Anonymous CSP violation reporter. Accepts both legacy application/csp-report and modern application/reports+json bodies and forwards each violation to PostHog as a $exception event. Always returns 204 - reporter errors must never affect user traffic. No route-level body validation: the modern Reporting API body is an ARRAY and the legacy body an object, and browsers add new report fields freely - route-schema 422s violated the fail-open contract (seen live 2026-07-04), so the handler alone parses via safeParse and drops what it cannot read.