The share sheet's OpenVibe Chat: /api/dm/users/search is a Bearer DM path (#396)

ddiff --git a/server/app.js b/server/app.js
iindex 8e233a4..f58610d 100644
---- a/server/app.js
++++ b/server/app.js
@@@ -131,7 +131,8 @@ function createApp({ chatServer, relay, events = null, callServer = null, settin
          return out;
      })();
      /** The Bearer-only DM reads and writes the shared navbar and Dock make from any OpenVibe site. */
--    const bearerDmPath = (p) => p === '/api/dm/unread' || p === '/api/dm/conversations' || p.startsWith('/api/dm/conversations/');
++    // /api/dm/users/search: the share sheet's "OpenVibe Chat" (Shared 4.144.0) starts a conversation by a person's name.
++    const bearerDmPath = (p) => p === '/api/dm/unread' || p === '/api/dm/conversations' || p.startsWith('/api/dm/conversations/') || p === '/api/dm/users/search';
  
      // ── Internal (loopback; never routed by nginx) ─────────────
      app.use('/internal/chat', express.json({ limit: '64kb' }), createInternalIngress({ chatServer }));
ddiff --git a/test/dock-signin.test.js b/test/dock-signin.test.js
iindex b8e5592..15cec67 100644
---- a/test/dock-signin.test.js
++++ b/test/dock-signin.test.js
@@@ -83,6 +83,11 @@ t('an OpenVibe site outside the credentialed list reads DMs with its Bearer, and
      assert.strictEqual(r.headers.get('access-control-allow-credentials'), null);
      assert.strictEqual((await h.http('GET', '/api/chat/search?q=hello', { token: normal(alice), headers: { origin } })).status, 403, 'only the DM paths, not the rest of the API');
      assert.strictEqual((await h.http('GET', '/api/dm/unread', { token: tok, headers: { origin: 'https://evil.example' } })).status, 403, 'a foreign web origin is still refused');
++    // The share sheet's OpenVibe Chat (Shared 4.144.0) finds a person by name from any OpenVibe site, the same way.
++    const found = await h.http('GET', '/api/dm/users/search?q=bo', { token: normal(alice), headers: { origin } });
++    assert.strictEqual(found.status, 200, found.text);
++    assert.strictEqual(found.headers.get('access-control-allow-origin'), origin);
++    assert.strictEqual(found.headers.get('access-control-allow-credentials'), null);
      const live = await h.http('GET', '/api/dm/unread', { token: tok, headers: { origin: 'https://openvibe.network' } });
      assert.strictEqual(live.headers.get('access-control-allow-credentials'), 'true', 'the credentialed list keeps its grant');
  });