Allow carried Live player frames on Video (#404)

ddiff --git a/server/app.js b/server/app.js
iindex d6e5ee3..b53bfd1 100644
---- a/server/app.js
++++ b/server/app.js
@@@ -140,7 +140,8 @@ async function createApp(opts = {}) {
                  // The watch page counts a view on OpenVibe.Live with a beacon (Live's /api/views).
                  // The navbar's Messages count asks Chat (openvibe-shared 4.130.0).
                  connectSrc: ["'self'", 'https://openvibe.community', 'https://openvibe.chat', 'https://openvibe.network', 'https://openvibe.quest', 'https://cloudflareinsights.com', 'https://openvibe.events', ...MEDIA_ORIGINS, liveOrigin],
--                frameSrc: ["'self'", 'https://openvibe.network'],
++                // Shared's portable player frames Live's first-party /embed page after a cross-site handoff.
++                frameSrc: ["'self'", 'https://openvibe.network', liveOrigin],
                  frameAncestors: ["'none'"],
                  objectSrc: ["'none'"],
                  baseUri: ["'self'"],
ddiff --git a/test/video-pages.test.js b/test/video-pages.test.js
iindex a9d7098..3e5702f 100644
---- a/test/video-pages.test.js
++++ b/test/video-pages.test.js
@@@ -406,6 +406,7 @@ function countOccurrences(haystack, needle) {
          assert.ok(/data-ovv-hls-lib="\/vendor\/hls\.light\.min\.js\?v=[0-9a-f]{10}"/.test(r.text), 'hls.js, self-hosted and content-hashed');
          assert.ok(/media-src[^;]*blob:/.test(String(r.headers['content-security-policy'])), 'MSE plays from blob:');
          assert.ok(/connect-src[^;]*https:\/\/openvibe\.live/.test(String(r.headers['content-security-policy'])), 'the beacon may reach Live');
++        assert.ok(/frame-src[^;]*https:\/\/openvibe\.live/.test(String(r.headers['content-security-policy'])), 'a carried live player may frame Live');
          assert.ok(r.text.includes('kind="captions"') && r.text.includes('src="/v/101/captions.vtt"'), 'the transcript track');
          assert.ok(r.text.includes('kind="chapters"') && r.text.includes('src="/v/101/chapters.vtt"'), 'the chapters track');
          assert.ok(r.text.includes('Chapters'));