fix(stats): enforce cleanup mode exclusivity and JSON requests

- Reject conflicting explicit cleanup modes
- Require application/json for duplicate-line maintenance requests

src/core/services/__tests__/stats-server.test.ts

@@ -1064,6 +1064,30 @@ describe('stats server API routes', () => {
     assert.deepEqual(seenOptions, { dryRun: true, lookbackDays: 30 });
   });
 
+  it('POST /api/stats/maintenance/duplicate-lines rejects cross-origin simple requests', async () => {
+    let cleanupCalls = 0;
+    const app = createStatsApp(
+      createMockTracker({
+        cleanupDuplicateSubtitleLines: async () => {
+          cleanupCalls += 1;
+          throw new Error('cleanup must not run');
+        },
+      }),
+    );
+
+    const res = await app.request('/api/stats/maintenance/duplicate-lines', {
+      method: 'POST',
+      headers: {
+        'Content-Type': 'text/plain',
+        Origin: 'https://attacker.example',
+      },
+      body: JSON.stringify({ dryRun: false, lookbackDays: null }),
+    });
+
+    assert.equal(res.status, 415);
+    assert.equal(cleanupCalls, 0);
+  });
+
   it('POST /api/stats/maintenance/duplicate-lines rejects a window shorter than a day', async () => {
     let cleanupCalls = 0;
     const app = createStatsApp(

src/core/services/stats-server/library-routes.ts

@@ -44,6 +44,8 @@ export function registerStatsLibraryRoutes(
   // Collapse animation bursts older versions recorded frame by frame. `dryRun` measures
   // the same scan without writing, so the confirmation the user sees is the real cost.
   app.post('/api/stats/maintenance/duplicate-lines', async (c) => {
+    const contentType = c.req.header('content-type')?.split(';', 1)[0]?.trim().toLowerCase();
+    if (contentType !== 'application/json') return c.body(null, 415);
     const body = await c.req.json().catch(() => null);
     const options = parseDuplicateLineCleanupBody(body);
     if (!options) return c.body(null, 400);