fix: close PI core chat review gaps

electron/api/server.ts

@@ -56,9 +56,12 @@ export function startHostApiServer(ctx: HostApiContext, port = getPort('NIANCODE
       }
 
       // ── Content-Type gate (anti-CSRF) ──────────────────────────
-      // Mutation requests must use application/json to force a CORS
-      // preflight, preventing "simple request" CSRF attacks.
-      if (!requireJsonContentType(req)) {
+      // Mutation requests use application/json, except the exact authenticated
+      // image-byte upload route. Its supported image MIME types also force a
+      // browser preflight and are validated before storage.
+      const isCodingAttachmentUpload = req.method === 'POST'
+        && requestUrl.pathname === '/api/coding/attachments';
+      if (!isCodingAttachmentUpload && !requireJsonContentType(req)) {
         sendJson(res, 415, { success: false, error: 'Content-Type must be application/json' });
         return;
       }