Return metadata as JSON body instead of response header

Fly.io proxy was stripping the custom X-Removed-Metadata header.
Now the web UI requests Accept: application/json and the /strip
endpoint returns {image, metadata} as JSON. Raw JPEG clients
still get the old behavior.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

server.js

@@ -394,6 +394,7 @@ app.get("/", (_req, res) => {
         headers: {
           "Authorization": "Bearer " + token,
           "Content-Type": file.type || "image/jpeg",
+          "Accept": "application/json",
         },
         body: file,
       });
@@ -410,11 +411,11 @@ app.get("/", (_req, res) => {
         throw new Error(err.message || "Strip failed");
       }
 
+      const data = await res.json();
+
       // Show removed metadata
-      const metaHeader = res.headers.get("X-Removed-Metadata");
+      const meta = data.metadata;
-      if (metaHeader) {
+      if (meta) {
-        try {
-          const meta = JSON.parse(metaHeader);
         const keys = Object.keys(meta);
         if (keys.length > 0) {
           keys.forEach(function(k) {
@@ -430,10 +431,13 @@ app.get("/", (_req, res) => {
           });
           removedDiv.style.display = "";
         }
-        } catch {}
       }
 
-      const blob = await res.blob();
+      // Download clean image
+      const byteString = atob(data.image);
+      const bytes = new Uint8Array(byteString.length);
+      for (let i = 0; i < byteString.length; i++) bytes[i] = byteString.charCodeAt(i);
+      const blob = new Blob([bytes], { type: "image/jpeg" });
       const url = URL.createObjectURL(blob);
       const a = document.createElement("a");
       const name = (file.name || "photo").replace(/\\.[^.]+$/, "") + "_clean.jpg";
@@ -536,11 +540,18 @@ app.post("/strip", async (req, res) => {
       }
 
       if (isAborted(req, res)) return;
+
+      // If client wants JSON, return image + metadata together
+      const wantsJson = String(req.headers["accept"] || "").includes("application/json");
+      if (wantsJson) {
+        res.setHeader("Content-Type", "application/json");
+        return res.json({
+          image: jpeg.toString("base64"),
+          metadata: removed,
+        });
+      }
+
       res.setHeader("Content-Type", "image/jpeg");
-      try {
-        res.setHeader("X-Removed-Metadata", JSON.stringify(removed));
-        res.setHeader("Access-Control-Expose-Headers", "X-Removed-Metadata");
-      } catch {}
       return res.send(jpeg);
     } catch (e) {
       const status = e?.statusCode || 500;