POST with x-revalidate-secret header and { tag } body calls revalidateTag to purge a collection from the Next.js data cache. Guarded by REVALIDATE_SECRET env var.