Allow Network session checks on Maps (#291)

ddiff --git a/apps/maps/server/index.js b/apps/maps/server/index.js
iindex 26b20b1..54df888 100644
---- a/apps/maps/server/index.js
++++ b/apps/maps/server/index.js
@@@ -85,7 +85,8 @@ app.use(helmet({
        // The navbar's Messages count asks Chat (openvibe-shared 4.130.0).
        connectSrc: ["'self'", "https://openvibe.chat", "nominatim.openstreetmap.org", "api.weather.gov", "api.open-meteo.com", "*.tile.openstreetmap.org", "*.basemaps.cartocdn.com", "server.arcgisonline.com", "https://openvibe.network", "https://openvibe.events", "https://cloudflareinsights.com"],
        fontSrc: ["'self'", "fonts.gstatic.com", "cdn.jsdelivr.net"],
--      frameSrc: ["'none'"],
++      // The navbar checks Network's session in a hidden /sso/check frame on typed arrivals.
++      frameSrc: ["https://openvibe.network"],
        scriptSrcAttr: ["'unsafe-inline'"],
      },
    },
ddiff --git a/apps/maps/test/csp.test.js b/apps/maps/test/csp.test.js
iindex 3664932..7a06847 100644
---- a/apps/maps/test/csp.test.js
++++ b/apps/maps/test/csp.test.js
@@@ -9,6 +9,7 @@ const { startApp } = require('../../_shared/test/spawn');
      try {
          const csp = (await fetch(`${maps.base}/`)).headers.get('content-security-policy') || '';
          assert.match(csp, /img-src[^;]*https:\/\/openvibe\.media(?:[ ;]|$)/, csp);
++        assert.match(csp, /(?:^|;)frame-src https:\/\/openvibe\.network(?:;|$)/, 'only Network may supply the silent session frame');
          console.log('  ✓ img-src allows https://openvibe.media');
      } finally {
          maps.kill('SIGTERM');
ddiff --git a/test/maps-csp.test.js b/test/maps-csp.test.js
nnew file mode 100644
iindex 0000000..953e99f
---- /dev/null
++++ b/test/maps-csp.test.js
@@@ -0,0 +1,3 @@
++'use strict';
++// Expose the Maps HTTP policy check to ov test's root-level test discovery.
++require('../apps/maps/test/csp.test.js');