I’m guessing a bit here, but I don’t think configuring CORS will work for this case. The origin (at least from the Obsidian Desktop app) is 'app://obsidian.md'. I think CORS can only be configured on Discourse to deal with HTTP requests.
@maxtim, do you need this to work from mobile, or would just being able to post to Discourse from the desktop app be good enough? I’m again guessing a bit, but… my understanding is that the desktop app is an Electron app. It’s running on a combination of Chromium and Node.js. You might be able to use node-fetch to make server-side requests to Discourse. If that works, it would take care of the CORS issue and let you use FormData in requests.