Internal-key retirement (WS-B task 3, C-54): the URL-registry refresh and the chat server's anon resolution ask Network with a service token (identity.subject.resolve), the key only as the fallback when no token can be had — they were the last two Live calls still sending X-Internal-Key

ddiff --git a/server/chat/chat-server.js b/server/chat/chat-server.js
iindex a64062ec..d88484ab 100644
---- a/server/chat/chat-server.js
++++ b/server/chat/chat-server.js
@@@ -164,11 +164,12 @@ class ChatServer {
  
          const promise = (async () => {
              try {
++                const auth = await require('../net/network-principal').headersFor('/internal/resolve-anon');
                  const res = await fetch(`${this._openvibeToolsUrl}/internal/resolve-anon`, {
                      method: 'POST',
                      headers: {
                          'Content-Type': 'application/json',
--                        'X-Internal-Key': this._internalKey,
++                        ...auth,
                      },
                      body: JSON.stringify({ ip }),
                  });
ddiff --git a/server/config.js b/server/config.js
iindex 72cbf2fa..fec9b25b 100644
---- a/server/config.js
++++ b/server/config.js
@@@ -289,17 +289,19 @@ const initialRegistry = resolveRegistryValues(process.env, {}, {}, URL_DEFINITIO
  const config = buildConfig(initialRegistry);
  
  async function refreshRegistry() {
--    if (!config.openvibeToolsInternalUrl || !config.internalApiKey) {
--        console.warn('[Config] Skipping registry refresh: missing internal URL or internal API key');
++    if (!config.openvibeToolsInternalUrl || (!config.internalApiKey && !process.env.OV_OAUTH_CLIENT_SECRET)) {
++        console.warn('[Config] Skipping registry refresh: missing internal URL, or neither a service identity nor an internal API key');
          return config;
      }
  
      try {
          const url = `${config.openvibeToolsInternalUrl.replace(/\/$/, '')}/internal/url-registry/resolved`;
++        // A service token (identity.subject.resolve) where one can be had; the key only as its fallback.
++        const auth = await require('./net/network-principal').headersFor('/internal/url-registry/resolved');
          const res = await fetch(url, {
              method: 'GET',
              headers: {
--                'X-Internal-Key': config.internalApiKey,
++                ...auth,
                  'Accept': 'application/json',
              },
              // Without a deadline this call can hang, and it runs during startup — an unreachable
ddiff --git a/server/net/network-principal.js b/server/net/network-principal.js
iindex 24647bef..45e49993 100644
---- a/server/net/network-principal.js
++++ b/server/net/network-principal.js
@@@ -20,7 +20,9 @@ const PAUSE_MS = 5 * 60 * 1000;
  // Network routes that accept a service token (OpenVibe.Network server/internal/routes.js TOKEN_ROUTES).
  const TOKEN_PATHS = new Set(['/internal/coins/credit', '/internal/coins/debit', '/internal/coins/transfer', '/internal/notifications/push', '/internal/notifications/push-bulk', '/internal/events/stream-live',
      // Network accepts a service token on these since 2026-09-24 (identity.subject.resolve / network.coins.credit).
--    '/internal/link-account', '/internal/identity/legacy-map', '/internal/identity/resolve-batch', '/internal/coins/stats', '/internal/resolve-anon']);
++    '/internal/link-account', '/internal/identity/legacy-map', '/internal/identity/resolve-batch', '/internal/coins/stats', '/internal/resolve-anon',
++    // identity.subject.resolve, which Network already guards it with (WS-B task 3, C-54).
++    '/internal/url-registry/resolved']);
  
  const _clients = new Map();
  /** One cached client-credentials token client per audience (openvibe.network, openvibe.community, ...). */