Allow browser SDK reads of shared ratings (#190)

ddiff --git a/server/http/api.js b/server/http/api.js
iindex b134112..c171539 100644
---- a/server/http/api.js
++++ b/server/http/api.js
@@@ -291,7 +291,7 @@ function createApi(ctx) {
      // ── Boards, models, datasets ────────────────────────────
      const ratingsCors = (_req, res, next) => {
          res.set('Access-Control-Allow-Origin', '*').set('Access-Control-Allow-Methods', 'GET, OPTIONS');
--        res.set('Access-Control-Allow-Headers', 'Accept, Content-Type');
++        res.set('Access-Control-Allow-Headers', 'Accept, Content-Type, traceparent, X-OpenVibe-Request-Id');
          next();
      };
      r.options('/ratings/:kindId', ratingsCors, (_req, res) => res.status(204).end());
ddiff --git a/test/boards.test.js b/test/boards.test.js
iindex c33ae84..d1c7ee8 100644
---- a/test/boards.test.js
++++ b/test/boards.test.js
@@@ -112,8 +112,10 @@ const { boot, check, done } = require('./helpers/boot');
          assert.strictEqual((await t.get('/api/v1/ratings/chat.willing')).status, 404);
          assert.strictEqual((await t.get('/api/v1/ratings/design.page?category=a&category=b')).status, 400);
          assert.strictEqual((await t.get('/api/v1/ratings/design.page?category=a%20b')).status, 422);
--        const options = await t.get('/api/v1/ratings/design.page', { method: 'OPTIONS' });
++        const options = await t.get('/api/v1/ratings/design.page', { method: 'OPTIONS', headers: { Origin: 'https://example.test', 'Access-Control-Request-Method': 'GET', 'Access-Control-Request-Headers': 'traceparent,x-openvibe-request-id,content-type' } });
          assert.strictEqual(options.status, 204);
++        const allowed = options.headers.get('access-control-allow-headers').toLowerCase().split(/,\s*/);
++        for (const header of ['traceparent', 'x-openvibe-request-id', 'content-type']) assert(allowed.includes(header), header);
          const doc = (await t.get('/openapi.json')).json();
          assert.ok(doc.paths['/api/v1/ratings/{kindId}'].get);
      });