Unauthenticated close endpoint for navigator.sendBeacon on tab close.

sendBeacon cannot carry custom headers, so we verify ownership by matching the viewer_wallet in the request body against the session's stored viewer_wallet. The session_id is a UUID (hard to guess) and the close operation is non-destructive (settles money TO the creator).

THE BODY IS PARSED BY HAND, AND THAT IS THE POINT. This route used to bind request: BeaconCloseRequest, which makes FastAPI require Content-Type: application/json — and a JSON Blob is not CORS-simple, so sendBeacon had to preflight it and the POST was dropped during unload. Clients now send text/plain to avoid the preflight, which a Pydantic body model answers with 422. parse_beacon_body accepts both shapes (and form-encoding) so the mini-app's vendored SDK snapshot keeps working unchanged while the new bundle rolls out.

An unreadable DURATION never blocks the close — it is telemetry, and settle_session bills from segment_count alone. An unreadable WALLET does, because on an unauthenticated endpoint it is the only authorisation there is; that is a 400, never a 500.