Sources' page wears the person's look and has its icon: connect-src allows the theme fetch and Cloudflare's report path (#184)

ddiff --git a/server/app.js b/server/app.js
iindex 58a56ac..ffd3022 100644
---- a/server/app.js
++++ b/server/app.js
@@@ -100,7 +100,7 @@ function createApp({ config, db, registry, items, ingest, scheduler, auth, outbo
              // edge and the privacy text says it may measure performance; script-src loads it, connect-src is
              // where it reports.
              // The page is the kit's (views/home.js): the theme loader and kit-web from this host's /shared.
--            res.setHeader('Content-Security-Policy', "default-src 'none'; style-src 'self' 'unsafe-inline'; script-src 'self' https://static.cloudflareinsights.com; img-src 'self' data:; connect-src https://cloudflareinsights.com; base-uri 'none'; frame-ancestors 'none'");
++            res.setHeader('Content-Security-Policy', "default-src 'none'; style-src 'self' 'unsafe-inline'; script-src 'self' https://static.cloudflareinsights.com; img-src 'self' data:; connect-src 'self' https://openvibe.network https://cloudflareinsights.com; base-uri 'none'; frame-ancestors 'none'");
              return res.type('html').send(homePage());
          }
          return res.type('text/plain').send(TEXT_INDEX);
ddiff --git a/server/views/merchant.js b/server/views/merchant.js
iindex 1618372..4edf631 100644
---- a/server/views/merchant.js
++++ b/server/views/merchant.js
@@@ -36,6 +36,7 @@ function layout({ title = 'List your store on OpenVibe', body = '', description
  <meta name="robots" content="noindex, nofollow">
  <meta name="color-scheme" content="dark light">
  <title>${esc(title)} · OpenVibe.Sources</title>
++${require('openvibe-shared/app-icon').headTags({ site: 'sources' }).replace(/<script[\s\S]*?<\/script>/g, '')}
  ${description ? `<meta name="description" content="${esc(description)}">` : ''}
  <script src="/shared/theme-loader.js"></script>
  <link rel="stylesheet" href="/shared/kit.css">
ddiff --git a/test/public-host.test.js b/test/public-host.test.js
iindex 6bfeac2..ddc259c 100644
---- a/test/public-host.test.js
++++ b/test/public-host.test.js
@@@ -26,7 +26,8 @@ t('browsers get a short honest HTML page in the network\'s kit: internal service
      assert.strictEqual(r.headers.get('cache-control'), 'no-store');
      assert.match(r.headers.get('content-security-policy'), /default-src 'none'/);
      // The kit's theme loader and kit-web from this host, and Cloudflare Web Analytics (injected at the edge); no inline script.
--    assert.match(r.headers.get('content-security-policy'), /script-src 'self' https:\/\/static\.cloudflareinsights\.com;[^]*connect-src https:\/\/cloudflareinsights\.com;/);
++    assert.match(r.headers.get('content-security-policy'), /script-src 'self' https:\/\/static\.cloudflareinsights\.com;[^]*connect-src 'self' https:\/\/openvibe\.network https:\/\/cloudflareinsights\.com;/, 'the theme fetch from openvibe.network, and Cloudflare\'s report path on this host');
++    assert.match(r.text, /<link rel="icon"[^>]*data-ov-icon="sources"/, 'the network\'s icon for Sources (no /favicon.ico 404)');
      for (const m of r.text.matchAll(/<script\b([^>]*)>/gi)) assert.match(m[1], /src="\/shared\//, 'every script is the kit\'s own file');
      assert.match(r.text, /<link rel="stylesheet" href="\/shared\/kit\.css">/, 'the network\'s kit');
      assert.match(r.text, /href="\/merchant"/, 'the merchant opt-in is one tap away');