Turns out the TPS23753A is a better chip choice. It's an 802.3at PoE controller combined with a flyback DC-DC controller. It's exactly what we need.

Still TBD is the physical form factor. At the moment, I'm considering a fully externalized design. Two RJ-45 jacks are the Ethernet+power input and Ethernet data output, and a USB-A jack is the output power. You'd use a short CAT 5 cable to go from the data jack to the Raspberry Pi, and a short USB A to µB cable to power the Pi.

But another way to do it would be to make a Pi Hat form factor board. It would have the two RJ-45 jacks, with the data jack positioned to be directly above the Raspberry Pi Ethernet port, so a very short cable could go from one to the other. The output power could be fed directly to the GPIO +5 pins, just as with Pi Power.