@Gargron Figured it out – it was a content-type issue: the JSON body parser in Express (Node) parses only 'application/json' by default. You have to specifically set it to also parse 'application/activity+json'. I had incorrectly assumed (never assume, etc.) that the default would be a wildcard on *json.
This is my personal Mastodon.