Allow Network session checks on Link and My (#793)

ddiff --git a/server/index.js b/server/index.js
iindex bfd0f2b3..2477d332 100644
---- a/server/index.js
++++ b/server/index.js
@@@ -151,7 +151,8 @@ app.use(helmet({
                  // The machine's live screen on the Link hub: OpenRestream's viewer signaling socket.
                  "wss://ingest.openre.stream",
              ],
--            frameSrc: ["'none'"],
++            // Link and My share this app on separate origins; their navbar checks Network's session.
++            frameSrc: ["https://openvibe.network"],
              scriptSrcAttr: ["'unsafe-inline'"],
          },
      },
ddiff --git a/test/home-image-csp.test.js b/test/home-image-csp.test.js
iindex cac62050..20ebad95 100644
---- a/test/home-image-csp.test.js
++++ b/test/home-image-csp.test.js
@@@ -17,6 +17,7 @@ const { bootServer } = require('./helpers/boot-server');
          // The machine hub's live screen (/machines) imports mediasoup-client's pinned ESM build and opens
          // OpenRestream's viewer signaling socket: exactly those two, in the two directives that gate them.
          const directive = (name) => csp.split(';').map((d) => d.trim()).find((d) => d.startsWith(name)) || '';
++        assert.strictEqual(directive('frame-src'), 'frame-src https://openvibe.network', 'the shared Link/My shell permits only Network session frames');
          assert.ok(directive('script-src').includes('https://esm.sh'), 'script-src lets the mediasoup client through');
          assert.ok(directive('connect-src').includes('wss://ingest.openre.stream'), 'connect-src lets the screen signaling through');
          console.log('CSP: home images, and the machine hub\'s live screen sources');