feat: Add POST /echo endpoint with JSON round-trip

[RobertGuajardo]

Summary

Adds a POST /echo endpoint to the dashboard server that returns the request body as JSON.

What

• Endpoint: POST /echo
• Happy path: Reads the request body, parses it as JSON, and echoes it back with Content-Type: application/json and HTTP 200
• Error path: Returns HTTP 400 with {"error": "invalid JSON"} for empty or malformed bodies
• CORS: Adds Access-Control-Allow-Origin: * header on all responses from this endpoint

Files Changed

• src/server/dashboard.ts — Added the /echo route handler before the catch-all HTML response
• tests/echo-endpoint.test.ts — 4 new tests covering: valid JSON echo, empty body 400, invalid JSON 400, and CORS header presence

Testing

All 166 unit/integration tests pass (0 failures), including the 4 new echo endpoint tests.

E2E curl testing against a live server on port 9999 verified:

Happy path: Simple objects, empty objects, deeply nested objects, Unicode/emoji, arrays at root, null/boolean/number/string values, large floats (1e308), large payloads (~1MB), and 50 concurrent requests all returned 200 with correct echoed body.

Error cases: Empty body, invalid JSON text, and truncated JSON all returned 400 + {"error": "invalid JSON"}.

Cross-cutting: CORS header present on both 200 and 400 responses; Content-Type: application/json on all responses; permissive about incoming Content-Type header (by design for a test echo endpoint).

Known gap: OPTIONS preflight returns 200 HTML (no CORS preflight headers) — acceptable for this internal testing endpoint.

[vercel]

@RobertGuajardo is attempting to deploy a commit to the Ryan Team on Vercel.

A member of the Team first needs to authorize it.

[RobertGuajardo]

Review: ✅ Approved

Clean, well-structured implementation. The streaming body collection, JSON parse/echo, and 400 error path are all correct. CORS header is applied consistently on both success and error responses.

Tests: Cover the essential cases — valid JSON echo (simple and nested objects), invalid JSON returning 400, and GET method falling through to HTML. Each test starts its own isolated server on port 0, which is good for test isolation.

Minor observations (non-blocking):

• No dedicated test asserting the CORS header value on responses — the behavior is correct in the implementation, just not explicitly exercised in the test suite. Worth adding in a follow-up if this endpoint sees broader use.
• Each test case spins up its own server; a shared before/after would be slightly more efficient, but isolation-first is a valid trade-off.

Overall: solid work. Shipping this.