Serve /release.json for the navbar's release watch (#6)

ddiff --git a/server/app.js b/server/app.js
iindex 193e9e6..4f7e181 100644
---- a/server/app.js
++++ b/server/app.js
@@@ -177,6 +177,9 @@ async function createApp(options = {}) {
          });
          res.json({ restricted: req.body.restricted });
      }));
++    // GET /release.json (ADR-016): the navbar's release watch polls it so open tabs learn of a new release (the 11-09
++    // browser sweep found it answering 404 here).
++    require('openvibe-shared/release').createRelease({ service: 'locker', root: path.join(__dirname, '..') }).mount(app);
      app.use('/shared', require('openvibe-shared/serve').handler());
      app.use(express.static(path.join(__dirname, '..', 'public'), { index: false, maxAge: '1h' }));
      app.use(require('./pages').createPages({ config }));
ddiff --git a/test/locker.test.js b/test/locker.test.js
iindex 6329a59..a69fbab 100644
---- a/test/locker.test.js
++++ b/test/locker.test.js
@@@ -21,6 +21,9 @@ test('password login items use people locks and remain opaque in storage', async
      assert.equal(new TextDecoder().decode(bytes).includes('secret-password'), false);
      assert.equal(new TextDecoder().decode(await locker.open(bytes, { person: t.people.get(SUBJECT) })), secret);
      assert.equal((await t.request('GET', '/api/v1/files')).status, 200);
++    const release = await t.request('GET', '/release.json');
++    assert.equal(release.status, 200, 'the navbar release watch polls /release.json');
++    assert.equal((await release.json()).service, 'locker');
  });
  test('WebCrypto stream → ciphertext API → download → authenticated opening, with private metadata', async () => {
      const file = new Blob([Buffer.alloc(2 * 1048576 + 93, 71)]);