571959900b
Enable urlencoded body parser, return XFX {code,message} without API envelope, and harden callback payload parsing.
Co-authored-by: Cursor <cursoragent@cursor.com>