openvibe-shared v4.133.0 (was v4.129.0) (#208)

ddiff --git a/README.md b/README.md
iindex 4dd5698..4d0c89d 100644
---- a/README.md
++++ b/README.md
@@@ -507,5 +507,5 @@ Part of the [OpenVibe network](https://openvibe.network). Built in the open by [
  <!-- versions:start -->
  - openvibe-contracts: v0.312.0
  - openvibe-sdk: v0.94.0
--- openvibe-shared: v4.129.0
++- openvibe-shared: v4.133.0
  <!-- versions:end -->
ddiff --git a/STATUS.json b/STATUS.json
iindex 70ecf25..9c57741 100644
---- a/STATUS.json
++++ b/STATUS.json
@@@ -11,7 +11,7 @@
    "database": "PostgreSQL 18 through PgBouncer (transaction mode) as the system of record, Valkey 9 for shared state (per-actor limits, overlay fan-out, overlay stream slots), ADR-035: database ov_tips from OpenVibe.Host's data role, schema in migrations/ (0001_initial expand, 0002_drop_legacy_import contract), async on openvibe-sdk/db v0.28.0, money paths serializable with row locks, PostgreSQL outbox and inbox.",
    "contracts": "openvibe-contracts v0.312.0",
    "sdk": "openvibe-sdk v0.94.0",
--  "shared": "openvibe-shared v4.129.0",
++  "shared": "openvibe-shared v4.133.0",
    "notes": "Runtime, API, SSR pages, overlays, the Billing settlement consumer and the events outbox are built, tested and deployed, together with /metrics (loopback only), truthful /api/ready (Billing and Events checks), supporter privacy (anonymous, hidden amount, private message), goal and supporter-page settings, export and erasure (tips.interaction.erased), moderation (word filter, hide/show, invited moderators, tips.interaction.moderated) and per-actor limits. Capabilities (18 tips.*) and payload schemas are in openvibe-contracts. Billing is the money ledger since the cutover (2026-10-17). A written internal threat review (docs/threat-review.md) with its fixes and test/security.test.js. Paid sounds (creators upload up to 12, supporters pay to play one on the overlay) since 2026-10-17. Not done: an independent security review.",
    "features": [
      "tips, paid messages, TTS and media requests settled by OpenVibe.Billing (never Tips' own money)",
ddiff --git a/package-lock.json b/package-lock.json
iindex 5e25a58..bcde40e 100644
---- a/package-lock.json
++++ b/package-lock.json
@@@ -15,7 +15,7 @@
          "iovalkey": "^0.4.0",
          "openvibe-contracts": "https://codeload.github.com/OpenVibers/OpenVibe.Contracts/tar.gz/refs/tags/v0.312.0",
          "openvibe-sdk": "https://codeload.github.com/OpenVibers/OpenVibe.SDK/tar.gz/refs/tags/v0.94.0",
--        "openvibe-shared": "https://codeload.github.com/OpenVibers/OpenVibe.Shared/tar.gz/refs/tags/v4.129.0",
++        "openvibe-shared": "https://codeload.github.com/OpenVibers/OpenVibe.Shared/tar.gz/refs/tags/v4.133.0",
          "pg": "^8.23.0"
        },
        "devDependencies": {
@@@ -1162,9 +1162,9 @@
        }
      },
      "node_modules/openvibe-shared": {
--      "version": "4.129.0",
--      "resolved": "https://codeload.github.com/OpenVibers/OpenVibe.Shared/tar.gz/refs/tags/v4.129.0",
--      "integrity": "sha512-wkBHrcR5C2mc+tmnIE4UVQaLztVNZtmg3xq1DQpaK1lqx3QshiVpBBAWkTvsaBMD5wOHxrXwfZ69pK6zCoFofQ==",
++      "version": "4.133.0",
++      "resolved": "https://codeload.github.com/OpenVibers/OpenVibe.Shared/tar.gz/refs/tags/v4.133.0",
++      "integrity": "sha512-ry+yvht0O+fHhMQr2LOaQKRYJo38d2cgsI3UtRmHge91qEQ/gL0wtcHawME1/G7V0NrlpdGzJMueKYd8UKrhjw==",
        "license": "MIT",
        "dependencies": {
          "jsonwebtoken": "^9.0.0",
ddiff --git a/package.json b/package.json
iindex e833c9a..114c661 100644
---- a/package.json
++++ b/package.json
@@@ -27,7 +27,7 @@
      "iovalkey": "^0.4.0",
      "openvibe-contracts": "https://codeload.github.com/OpenVibers/OpenVibe.Contracts/tar.gz/refs/tags/v0.312.0",
      "openvibe-sdk": "https://codeload.github.com/OpenVibers/OpenVibe.SDK/tar.gz/refs/tags/v0.94.0",
--    "openvibe-shared": "https://codeload.github.com/OpenVibers/OpenVibe.Shared/tar.gz/refs/tags/v4.129.0",
++    "openvibe-shared": "https://codeload.github.com/OpenVibers/OpenVibe.Shared/tar.gz/refs/tags/v4.133.0",
      "pg": "^8.23.0"
    },
    "engines": {
ddiff --git a/server/app.js b/server/app.js
iindex 35fd6a3..23bb86e 100644
---- a/server/app.js
++++ b/server/app.js
@@@ -114,7 +114,8 @@ function createApp(opts = {}) {
          // connect-src openvibe.events: release notifications (release-watch's EventSource, openvibe-shared 1.17).
          res.setHeader('Content-Security-Policy', [
              "default-src 'self'", "script-src 'self' 'unsafe-inline' https://openvibe.network https://static.cloudflareinsights.com", "style-src 'self' 'unsafe-inline' https://openvibe.network",
--            "img-src 'self' data: https:", "media-src 'self' https:", "connect-src 'self' https://openvibe.network https://openvibe.events https://cloudflareinsights.com", "frame-src 'self' https://openvibe.network",
++            // The navbar's Messages count asks Chat (openvibe-shared 4.130.0).
++            "img-src 'self' data: https:", "media-src 'self' https:", "connect-src 'self' https://openvibe.chat https://openvibe.network https://openvibe.events https://cloudflareinsights.com", "frame-src 'self' https://openvibe.network",
              "frame-ancestors 'self'", "object-src 'none'", "base-uri 'self'", "form-action 'self' https://openvibe.network https:",
          ].join('; '));
          next();