Confirm the proposal with the user's final scope_by_integration.

Body shape (JSON in any Content-Type — see below): {"scope_by_integration": {<slug>: <ScopeConfig>, ...}}

We read the raw request body and parse JSON ourselves rather than relying on FastAPI's Body(...) because the iframe deliberately sends the POST WITHOUT Content-Type: application/json to keep it inside the CORS "simple request" rules. Setting Content-Type to application/json would trigger a browser preflight (OPTIONS), and Cloudflare quick-tunnel (trycloudflare.com) blocks preflights with Origin: https://*.claudemcpcontent.com — they get 400 "Disallowed CORS origin". Simple requests skip preflight entirely so the POST gets through to our handler, which returns proper Access-Control-Allow-Origin: * for the response itself.