POST /api/extract returns verified JSON with a needs_review flag per field — reflects the text, fields & models. Same origin, no key needed by the caller.