[Feature]: [P2] The desktop ingest route sends no CORS headers and answers OPTIONS with 405

Recorded from the Edge Case Hunter's review of analytics stage 2, as a constraint the client stage must design around rather than discover.

app://game to https://verticopolis.com/api/ingest/desktop is cross-origin by construction, always. The route's method gate runs first and returns a bare 405 for any non-POST, so a CORS preflight gets no Access-Control-Allow-* headers, and the 204 success path carries no Access-Control-Allow-Origin either.

Consequences for the client transport:

• sendBeacon with a string works: it sends text/plain, which is a simple request, so no preflight.
• A fetch fallback must use mode: "no-cors" and must not set a JSON content type or any custom header, or the browser preflights and the request never arrives.
• Under no-cors the response is opaque, so the client cannot read the status. A 429 or a 400 is indistinguishable from a 204. The client cannot implement retry-on-rate-limit, and should not try.

The party ruling already anticipated the no-cors requirement for the fetch fallback. What it did not record is the opaque-response consequence, which means the client stage has no way to detect server-side rejection and must treat every send as fire-and-forget.

Decide before the client stage: either accept the constraint and document it in the relay (cheapest, and consistent with the ruling's offline posture of dropping events rather than persisting them), or add preflight and ACAO handling to the desktop route so the client can observe failures. The former is recommended; the latter buys observability the ruling does not otherwise ask for.

A NOTE FOR THE CLIENT STAGE comment recording this now lives in api/ingest/desktop.ts.

Start in api/ingest/desktop.ts, reading the method gate and the 204 success path to confirm their current CORS behavior. Decide whether the relay should document the fire-and-forget constraint or the route should add preflight and ACAO handling; done means the selected behavior is recorded and consistent with the client-stage ruling.