Api App State Put

Merge a patch into this viewer's saved state for this app (ENG-1143).

POST with a text/plain body on purpose: the caller is a sandboxed frame, whose opaque origin makes every request cross-origin. A PUT or a JSON content-type would trigger a CORS preflight, and answering preflights would mean opening methods and headers on a token-gated public endpoint. This shape is a "simple request" — no preflight to answer, no CORS surface added, and it is what navigator.sendBeacon can send as the page goes away.

Body: {"patch": {...}, "remove": ["key", ...]}. A patch rather than a whole document so two tabs of the same app cannot delete each other's keys.