Console CSP: allow avatars from openvibe.media in img-src (#258)

ddiff --git a/server/console/views.js b/server/console/views.js
iindex 86363d0..c8553f3 100644
---- a/server/console/views.js
++++ b/server/console/views.js
@@@ -58,7 +58,7 @@ dl{display:grid;grid-template-columns:max-content 1fr;gap:6px 16px;margin:0}dt{c
  .shipped{max-width:1180px;margin:24px auto;padding:0 16px 24px;color:var(--muted);font-size:.85rem}
  `;
  const CSS_HASH = `sha256-${crypto.createHash('sha256').update(CSS).digest('base64')}`;
--const CSP = `default-src 'none'; style-src '${CSS_HASH}'; img-src 'self'; form-action 'self'; frame-ancestors 'none'; base-uri 'none'`;
++const CSP = `default-src 'none'; style-src '${CSS_HASH}'; img-src 'self' https://openvibe.media; form-action 'self'; frame-ancestors 'none'; base-uri 'none'`;
  
  // ── Formatting ───────────────────────────────────────────────
  const n = (v) => Number(v || 0).toLocaleString('en-US');
ddiff --git a/test/console.test.js b/test/console.test.js
iindex 2c7649e..88b9503 100644
---- a/test/console.test.js
++++ b/test/console.test.js
@@@ -168,6 +168,7 @@ const DAY = 86_400_000;
              assert.strictEqual(r.headers.get('x-robots-tag'), 'noindex, nofollow');
              assert.strictEqual(r.headers.get('cache-control'), 'no-store');
              assert.match(r.headers.get('content-security-policy'), /default-src 'none'.*form-action 'self'.*frame-ancestors 'none'/);
++            assert.match(r.headers.get('content-security-policy'), /img-src 'self' https:\/\/openvibe\.media(?:;|$)/, `${p} lets an avatar from openvibe.media show`);
              assert.strictEqual(r.headers.get('x-frame-options'), 'DENY');
          }
          const anon = await get('/cashouts');