The 13 domains bought 10-28 are owned zones, parked at where each capability lives today (#377)

ddiff --git a/deploy/nginx/parked-domains.conf b/deploy/nginx/parked-domains.conf
iindex 4b96f7c4..417660f5 100644
---- a/deploy/nginx/parked-domains.conf
++++ b/deploy/nginx/parked-domains.conf
@@@ -13,6 +13,8 @@
  #   openvibe.homes left on 2026-10-15: OpenVibe.Homes is served by OpenVibe.Rent (OpenVibe.Rent deploy/nginx/openvibe.homes.conf).
  #   openvibe.run left on 2026-10-11: OpenVibe.Run serves it (OpenVibe.Run deploy/nginx/openvibe.run.conf).
  #   realtime.openvibe.network: OpenVibe.Realtime is closed; delivery is OpenVibe.Events.
++#   2026-10-28: the thirteen domains bought that day (open.shoes and twelve openvibe.*) are parked here, each sent to
++#     where its capability lives today, until its room's own vhost takes the name (plan: OpenVibe_New_Domains_Plan).
  #
  # Install: sudo ov-vhost-install deploy/nginx/parked-domains.conf parked-domains.conf
  # after removing Sites' vhost for each name. Each name uses its own certificate (a vhost must use its own
@@@ -54,3 +56,289 @@ server {
      access_log off;
      return 302 https://openvibe.network/;
  }
++
++# open.shoes → shoe deals on Deals
++server {
++    listen 80;
++    listen [::]:80;
++    server_name open.shoes www.open.shoes;
++    return 302 https://openvibe.deals/search?q=shoes;
++}
++
++server {
++    listen 443 ssl;
++    listen [::]:443 ssl;
++    http2 on;
++    server_name open.shoes www.open.shoes;
++    ssl_certificate     /etc/letsencrypt/live/open.shoes/fullchain.pem;
++    ssl_certificate_key /etc/letsencrypt/live/open.shoes/privkey.pem;
++    add_header Strict-Transport-Security "max-age=15552000; includeSubDomains" always;
++    add_header X-Content-Type-Options "nosniff" always;
++    add_header Referrer-Policy "strict-origin-when-cross-origin" always;
++    access_log off;
++    return 302 https://openvibe.deals/search?q=shoes;
++}
++
++# openvibe.today → the network's front door (what's on now)
++server {
++    listen 80;
++    listen [::]:80;
++    server_name openvibe.today www.openvibe.today;
++    return 302 https://openvibe.network/;
++}
++
++server {
++    listen 443 ssl;
++    listen [::]:443 ssl;
++    http2 on;
++    server_name openvibe.today www.openvibe.today;
++    ssl_certificate     /etc/letsencrypt/live/openvibe.today/fullchain.pem;
++    ssl_certificate_key /etc/letsencrypt/live/openvibe.today/privkey.pem;
++    add_header Strict-Transport-Security "max-age=15552000; includeSubDomains" always;
++    add_header X-Content-Type-Options "nosniff" always;
++    add_header Referrer-Policy "strict-origin-when-cross-origin" always;
++    access_log off;
++    return 302 https://openvibe.network/;
++}
++
++# openvibe.vision → AI, whose models read pictures
++server {
++    listen 80;
++    listen [::]:80;
++    server_name openvibe.vision www.openvibe.vision;
++    return 302 https://ai.openvibe.services/;
++}
++
++server {
++    listen 443 ssl;
++    listen [::]:443 ssl;
++    http2 on;
++    server_name openvibe.vision www.openvibe.vision;
++    ssl_certificate     /etc/letsencrypt/live/openvibe.vision/fullchain.pem;
++    ssl_certificate_key /etc/letsencrypt/live/openvibe.vision/privkey.pem;
++    add_header Strict-Transport-Security "max-age=15552000; includeSubDomains" always;
++    add_header X-Content-Type-Options "nosniff" always;
++    add_header Referrer-Policy "strict-origin-when-cross-origin" always;
++    access_log off;
++    return 302 https://ai.openvibe.services/;
++}
++
++# openvibe.domains → Host's domain price comparison
++server {
++    listen 80;
++    listen [::]:80;
++    server_name openvibe.domains www.openvibe.domains;
++    return 302 https://openvibe.host/catalog/domains;
++}
++
++server {
++    listen 443 ssl;
++    listen [::]:443 ssl;
++    http2 on;
++    server_name openvibe.domains www.openvibe.domains;
++    ssl_certificate     /etc/letsencrypt/live/openvibe.domains/fullchain.pem;
++    ssl_certificate_key /etc/letsencrypt/live/openvibe.domains/privkey.pem;
++    add_header Strict-Transport-Security "max-age=15552000; includeSubDomains" always;
++    add_header X-Content-Type-Options "nosniff" always;
++    add_header Referrer-Policy "strict-origin-when-cross-origin" always;
++    access_log off;
++    return 302 https://openvibe.host/catalog/domains;
++}
++
++# openvibe.report → the network's open stats
++server {
++    listen 80;
++    listen [::]:80;
++    server_name openvibe.report www.openvibe.report;
++    return 302 https://openvibe.network/stats;
++}
++
++server {
++    listen 443 ssl;
++    listen [::]:443 ssl;
++    http2 on;
++    server_name openvibe.report www.openvibe.report;
++    ssl_certificate     /etc/letsencrypt/live/openvibe.report/fullchain.pem;
++    ssl_certificate_key /etc/letsencrypt/live/openvibe.report/privkey.pem;
++    add_header Strict-Transport-Security "max-age=15552000; includeSubDomains" always;
++    add_header X-Content-Type-Options "nosniff" always;
++    add_header Referrer-Policy "strict-origin-when-cross-origin" always;
++    access_log off;
++    return 302 https://openvibe.network/stats;
++}
++
++# openvibe.meme → Live's clips, where the memes come from
++server {
++    listen 80;
++    listen [::]:80;
++    server_name openvibe.meme www.openvibe.meme;
++    return 302 https://openvibe.live/clips;
++}
++
++server {
++    listen 443 ssl;
++    listen [::]:443 ssl;
++    http2 on;
++    server_name openvibe.meme www.openvibe.meme;
++    ssl_certificate     /etc/letsencrypt/live/openvibe.meme/fullchain.pem;
++    ssl_certificate_key /etc/letsencrypt/live/openvibe.meme/privkey.pem;
++    add_header Strict-Transport-Security "max-age=15552000; includeSubDomains" always;
++    add_header X-Content-Type-Options "nosniff" always;
++    add_header Referrer-Policy "strict-origin-when-cross-origin" always;
++    access_log off;
++    return 302 https://openvibe.live/clips;
++}
++
++# openvibe.casino → Games
++server {
++    listen 80;
++    listen [::]:80;
++    server_name openvibe.casino www.openvibe.casino;
++    return 302 https://openvibe.games/;
++}
++
++server {
++    listen 443 ssl;
++    listen [::]:443 ssl;
++    http2 on;
++    server_name openvibe.casino www.openvibe.casino;
++    ssl_certificate     /etc/letsencrypt/live/openvibe.casino/fullchain.pem;
++    ssl_certificate_key /etc/letsencrypt/live/openvibe.casino/privkey.pem;
++    add_header Strict-Transport-Security "max-age=15552000; includeSubDomains" always;
++    add_header X-Content-Type-Options "nosniff" always;
++    add_header Referrer-Policy "strict-origin-when-cross-origin" always;
++    access_log off;
++    return 302 https://openvibe.games/;
++}
++
++# openvibe.surf → Games
++server {
++    listen 80;
++    listen [::]:80;
++    server_name openvibe.surf www.openvibe.surf;
++    return 302 https://openvibe.games/;
++}
++
++server {
++    listen 443 ssl;
++    listen [::]:443 ssl;
++    http2 on;
++    server_name openvibe.surf www.openvibe.surf;
++    ssl_certificate     /etc/letsencrypt/live/openvibe.surf/fullchain.pem;
++    ssl_certificate_key /etc/letsencrypt/live/openvibe.surf/privkey.pem;
++    add_header Strict-Transport-Security "max-age=15552000; includeSubDomains" always;
++    add_header X-Content-Type-Options "nosniff" always;
++    add_header Referrer-Policy "strict-origin-when-cross-origin" always;
++    access_log off;
++    return 302 https://openvibe.games/;
++}
++
++# openvibe.fun → Games
++server {
++    listen 80;
++    listen [::]:80;
++    server_name openvibe.fun www.openvibe.fun;
++    return 302 https://openvibe.games/;
++}
++
++server {
++    listen 443 ssl;
++    listen [::]:443 ssl;
++    http2 on;
++    server_name openvibe.fun www.openvibe.fun;
++    ssl_certificate     /etc/letsencrypt/live/openvibe.fun/fullchain.pem;
++    ssl_certificate_key /etc/letsencrypt/live/openvibe.fun/privkey.pem;
++    add_header Strict-Transport-Security "max-age=15552000; includeSubDomains" always;
++    add_header X-Content-Type-Options "nosniff" always;
++    add_header Referrer-Policy "strict-origin-when-cross-origin" always;
++    access_log off;
++    return 302 https://openvibe.games/;
++}
++
++# openvibe.tours → Live, where IRL streams walk places
++server {
++    listen 80;
++    listen [::]:80;
++    server_name openvibe.tours www.openvibe.tours;
++    return 302 https://openvibe.live/;
++}
++
++server {
++    listen 443 ssl;
++    listen [::]:443 ssl;
++    http2 on;
++    server_name openvibe.tours www.openvibe.tours;
++    ssl_certificate     /etc/letsencrypt/live/openvibe.tours/fullchain.pem;
++    ssl_certificate_key /etc/letsencrypt/live/openvibe.tours/privkey.pem;
++    add_header Strict-Transport-Security "max-age=15552000; includeSubDomains" always;
++    add_header X-Content-Type-Options "nosniff" always;
++    add_header Referrer-Policy "strict-origin-when-cross-origin" always;
++    access_log off;
++    return 302 https://openvibe.live/;
++}
++
++# openvibe.exchange → Services, the developer hub
++server {
++    listen 80;
++    listen [::]:80;
++    server_name openvibe.exchange www.openvibe.exchange;
++    return 302 https://openvibe.services/;
++}
++
++server {
++    listen 443 ssl;
++    listen [::]:443 ssl;
++    http2 on;
++    server_name openvibe.exchange www.openvibe.exchange;
++    ssl_certificate     /etc/letsencrypt/live/openvibe.exchange/fullchain.pem;
++    ssl_certificate_key /etc/letsencrypt/live/openvibe.exchange/privkey.pem;
++    add_header Strict-Transport-Security "max-age=15552000; includeSubDomains" always;
++    add_header X-Content-Type-Options "nosniff" always;
++    add_header Referrer-Policy "strict-origin-when-cross-origin" always;
++    access_log off;
++    return 302 https://openvibe.services/;
++}
++
++# openvibe.cam → going live with your camera on Live
++server {
++    listen 80;
++    listen [::]:80;
++    server_name openvibe.cam www.openvibe.cam;
++    return 302 https://openvibe.live/broadcast;
++}
++
++server {
++    listen 443 ssl;
++    listen [::]:443 ssl;
++    http2 on;
++    server_name openvibe.cam www.openvibe.cam;
++    ssl_certificate     /etc/letsencrypt/live/openvibe.cam/fullchain.pem;
++    ssl_certificate_key /etc/letsencrypt/live/openvibe.cam/privkey.pem;
++    add_header Strict-Transport-Security "max-age=15552000; includeSubDomains" always;
++    add_header X-Content-Type-Options "nosniff" always;
++    add_header Referrer-Policy "strict-origin-when-cross-origin" always;
++    access_log off;
++    return 302 https://openvibe.live/broadcast;
++}
++
++# openvibe.design → the network's themes
++server {
++    listen 80;
++    listen [::]:80;
++    server_name openvibe.design www.openvibe.design;
++    return 302 https://openvibe.network/themes;
++}
++
++server {
++    listen 443 ssl;
++    listen [::]:443 ssl;
++    http2 on;
++    server_name openvibe.design www.openvibe.design;
++    ssl_certificate     /etc/letsencrypt/live/openvibe.design/fullchain.pem;
++    ssl_certificate_key /etc/letsencrypt/live/openvibe.design/privkey.pem;
++    add_header Strict-Transport-Security "max-age=15552000; includeSubDomains" always;
++    add_header X-Content-Type-Options "nosniff" always;
++    add_header Referrer-Policy "strict-origin-when-cross-origin" always;
++    access_log off;
++    return 302 https://openvibe.network/themes;
++}
ddiff --git a/public/js/login.js b/public/js/login.js
iindex a1bfbe01..4d117b4f 100644
---- a/public/js/login.js
++++ b/public/js/login.js
@@@ -465,7 +465,7 @@ function ripple(btn, e) {
  // safe-redirect:begin
  // Where a sign-in may send the browser: a path on this site, this origin, or https on a zone
  // OpenVibe owns (server/auth/sso-owned.js). Never javascript:/data:, never another host.
--const OV_OWNED_ZONES = ['openvibe.network', 'openvibe.live', 'openvibe.tools', 'openvibe.media', 'openvibe.games', 'openvibe.community', 'openvibe.space', 'openvibe.chat', 'openvibe.codes', 'openvibe.blog', 'openvibe.wiki', 'openvibe.news', 'openvibe.reviews', 'openvibe.tips', 'openvibe.vip', 'openvibe.trade', 'openvibe.host', 'openvibe.deals', 'openvibe.coupons', 'openre.stream'];
++const OV_OWNED_ZONES = ['openvibe.network', 'openvibe.live', 'openvibe.tools', 'openvibe.media', 'openvibe.games', 'openvibe.community', 'openvibe.space', 'openvibe.chat', 'openvibe.codes', 'openvibe.blog', 'openvibe.wiki', 'openvibe.news', 'openvibe.reviews', 'openvibe.tips', 'openvibe.vip', 'openvibe.trade', 'openvibe.host', 'openvibe.deals', 'openvibe.coupons', 'openre.stream', 'open.shoes', 'openvibe.today', 'openvibe.vision', 'openvibe.domains', 'openvibe.report', 'openvibe.meme', 'openvibe.casino', 'openvibe.surf', 'openvibe.fun', 'openvibe.tours', 'openvibe.exchange', 'openvibe.cam', 'openvibe.design'];
  const OV_USER_CONTENT_ZONES = ['openvibe.host']; // tenant sites: only the apex is ours
  function safeReturnUrl(raw) {
      const s = String(raw == null ? '' : raw);
ddiff --git a/public/sso-fanout.html b/public/sso-fanout.html
iindex 2e0a8cfd..1d42e423 100644
---- a/public/sso-fanout.html
++++ b/public/sso-fanout.html
@@@ -66,7 +66,7 @@ li.now .dot i{animation:spin 1s linear infinite}
    // safe-redirect:begin
    // Where a sign-in may send the browser: a path on this site, this origin, or https on a zone
    // OpenVibe owns (server/auth/sso-owned.js). Never javascript:/data:, never another host.
--  const OV_OWNED_ZONES = ['openvibe.network', 'openvibe.live', 'openvibe.tools', 'openvibe.media', 'openvibe.games', 'openvibe.community', 'openvibe.space', 'openvibe.chat', 'openvibe.codes', 'openvibe.blog', 'openvibe.wiki', 'openvibe.news', 'openvibe.reviews', 'openvibe.tips', 'openvibe.vip', 'openvibe.trade', 'openvibe.host', 'openvibe.deals', 'openvibe.coupons', 'openre.stream'];
++  const OV_OWNED_ZONES = ['openvibe.network', 'openvibe.live', 'openvibe.tools', 'openvibe.media', 'openvibe.games', 'openvibe.community', 'openvibe.space', 'openvibe.chat', 'openvibe.codes', 'openvibe.blog', 'openvibe.wiki', 'openvibe.news', 'openvibe.reviews', 'openvibe.tips', 'openvibe.vip', 'openvibe.trade', 'openvibe.host', 'openvibe.deals', 'openvibe.coupons', 'openre.stream', 'open.shoes', 'openvibe.today', 'openvibe.vision', 'openvibe.domains', 'openvibe.report', 'openvibe.meme', 'openvibe.casino', 'openvibe.surf', 'openvibe.fun', 'openvibe.tours', 'openvibe.exchange', 'openvibe.cam', 'openvibe.design'];
    const OV_USER_CONTENT_ZONES = ['openvibe.host']; // tenant sites: only the apex is ours
    function safeNext(raw) {
        const s = String(raw == null ? '' : raw);
ddiff --git a/server/auth/sso-owned.js b/server/auth/sso-owned.js
iindex 674f534b..d55b199a 100644
---- a/server/auth/sso-owned.js
++++ b/server/auth/sso-owned.js
@@@ -6,6 +6,7 @@ const OWNED_ZONES = [
      'openvibe.chat', 'openvibe.codes', 'openvibe.blog', 'openvibe.wiki', 'openvibe.news', 'openvibe.reviews',
      'openvibe.tips', 'openvibe.vip', 'openvibe.trade', 'openvibe.host', 'openvibe.deals', 'openvibe.coupons',
      'openre.stream',
++    'open.shoes', 'openvibe.today', 'openvibe.vision', 'openvibe.domains', 'openvibe.report', 'openvibe.meme', 'openvibe.casino', 'openvibe.surf', 'openvibe.fun', 'openvibe.tours', 'openvibe.exchange', 'openvibe.cam', 'openvibe.design',
  ];
  // Zones whose subdomains are people's own content (OpenVibe.Host tenant sites, <site>.openvibe.host,
  // which run the tenant's JS): only the apex is OpenVibe's. Domain validation still refuses them as