Trim STATUS capabilities and assert bearer skips cookie metric (#11)

ddiff --git a/STATUS.json b/STATUS.json
iindex 80b779c..66d3816 100644
---- a/STATUS.json
++++ b/STATUS.json
@@@ -8,7 +8,7 @@
    "port": 4400,
    "domain": "openvibe.chat (Chat's own site: global chat, messages, rooms, settings; the service manifest records it live since 2026-09-24) and openvibe.live (/ws/chat, /api/chat/, /api/dm/, /api/tts/, /api/sounds via an nginx include in openvibe.live's vhost)",
    "contracts": "openvibe-contracts v0.71.0",
--  "capabilities": ["chat.live_bridge.write", "chat.message.send", "chat.presence.read"],
++  "capabilities": ["chat.message.send"],
    "capabilitiesUsed": [
      "live.chat_context.read",
      "live.chat_effects.write",
ddiff --git a/test/network-session.test.js b/test/network-session.test.js
iindex 73f8af1..1ecaf26 100644
---- a/test/network-session.test.js
++++ b/test/network-session.test.js
@@@ -140,12 +140,14 @@ t('an ov_token cookie that does not resolve to an account is not counted', async
  
  t('bots authenticate the upgrade with an Authorization header, no token in the URL', async () => {
      const before = require('../server/auth/auth').urlTokenUses();
++    const cookieBefore = require('../server/auth/auth').wsCookieUses();
      const ws = await h.ws({ bearer: jwt(claimsFor(carol)) });
      ws.sendJson({ type: 'join' });
      const auth = await ws.next((m) => m.type === 'auth');
      assert.deepStrictEqual([auth.authenticated, auth.core_username], [true, 'carol']);
      ws.close();
      assert.deepStrictEqual(require('../server/auth/auth').urlTokenUses(), before, 'not counted as a URL token');
++    assert.deepStrictEqual(require('../server/auth/auth').wsCookieUses(), cookieBefore, 'a bearer upgrade is not counted as a cookie use');
  });
  
  t.run(async () => { if (h && h.close) await h.close(); });