upsert-simple accepts any internal postType/pageType int, not just the sensible public ones

upsert-simple will happily accept any internal enum value for postType and pageType — there's no whitelist restricting them to the handful that make sense over the public API.

The value flows straight into page/post creation, so a caller can create structurally odd posts and pages that the UI would never let you make — e.g. a Form page, a PrivateChat, a Forum, a MetaMessage, or a Bookmark.

Who it bites: anyone scripting bulk upserts who fat-fingers a type int, or copies a value out of the internal enums assuming the public path validates it. Nothing warns you; you just get a weird page.

Minor, and it needs a valid site secret to reach — but a small allow-list would turn a silent "you now have a Form page" into a clean 400. This complements the general upsert-vs-UI-shape mismatch story.