CSP allows the network sign-in probe and Cloudflare beacon; inline favicon; vendor sync

ddiff --git a/apps/gateway/server/index.js b/apps/gateway/server/index.js
iindex 86b4249..15ee98f 100644
---- a/apps/gateway/server/index.js
++++ b/apps/gateway/server/index.js
@@@ -41,12 +41,12 @@ app.use(helmet({
      contentSecurityPolicy: {
          directives: {
              defaultSrc: ["'self'"],
--            scriptSrc: ["'self'", "'unsafe-inline'", "https://openvibe.network", "https://openvibe.live", "cdnjs.cloudflare.com", "cdn.jsdelivr.net", "fonts.googleapis.com"],
++            scriptSrc: ["'self'", "'unsafe-inline'", "https://openvibe.network", "https://openvibe.live", "cdnjs.cloudflare.com", "cdn.jsdelivr.net", "fonts.googleapis.com", "https://static.cloudflareinsights.com"],
              styleSrc: ["'self'", "'unsafe-inline'", "cdnjs.cloudflare.com", "fonts.googleapis.com", "fonts.gstatic.com"],
              fontSrc: ["'self'", "fonts.gstatic.com", "cdnjs.cloudflare.com"],
              imgSrc: ["'self'", "data:", "blob:", "https://openvibe.network", "https://openvibe.media"],
--            connectSrc: ["'self'", "https://openvibe.network", "https://openvibe.tools", "https://*.openvibe.tools", "https://openvibe.media", "https://openvibe.live", "https://openvibe.games"],
--            frameSrc: ["'none'"],
++            connectSrc: ["'self'", "https://cloudflareinsights.com", "https://openvibe.network", "https://openvibe.tools", "https://*.openvibe.tools", "https://openvibe.media", "https://openvibe.live", "https://openvibe.games"],
++            frameSrc: ["https://openvibe.network"], // the hidden /sso/check sign-in probe
              scriptSrcAttr: ["'unsafe-inline'"],
          },
      },
ddiff --git a/apps/gateway/server/pages/site.js b/apps/gateway/server/pages/site.js
iindex 80112a4..3b6c17c 100644
---- a/apps/gateway/server/pages/site.js
++++ b/apps/gateway/server/pages/site.js
@@@ -86,7 +86,7 @@ const NETWORK = [
  function shell({ head, body, families }) {
      return `<!DOCTYPE html><html lang="en"><head><meta charset="utf-8"><meta name="viewport" content="width=device-width,initial-scale=1"><meta name="theme-color" content="#3b82f6">
  ${head}
--<link rel="icon" type="image/svg+xml" href="https://openvibe.network/assets/favicon.svg">
++<link rel="icon" type="image/svg+xml" href="data:image/svg+xml,%3Csvg xmlns='http://www.w3.org/2000/svg' viewBox='0 0 48 48'%3E%3Ccircle cx='24' cy='24' r='22' fill='%230b1220'/%3E%3Ccircle cx='24' cy='24' r='18' fill='none' stroke='%233b82f6' stroke-width='4'/%3E%3Cpath d='M14.5 17 24 34l9.5-17' fill='none' stroke='%23fff' stroke-width='4.6' stroke-linecap='round' stroke-linejoin='round'/%3E%3C/svg%3E">
  <link rel="alternate" type="application/json" href="${SITE}/api/catalog.json" title="Tool catalog">
  <link rel="preconnect" href="https://openvibe.network">
  <script src="https://openvibe.network/shared/theme-loader.js"></script>
ddiff --git a/apps/yt/public/index.html b/apps/yt/public/index.html
iindex bf28650..ef3d0b6 100644
---- a/apps/yt/public/index.html
++++ b/apps/yt/public/index.html
@@@ -4,6 +4,7 @@
      <meta charset="UTF-8">
      <meta name="viewport" content="width=device-width, initial-scale=1.0">
      <!--OV:HEAD-->
++    <link rel="icon" type="image/svg+xml" href="data:image/svg+xml,%3Csvg xmlns='http://www.w3.org/2000/svg' viewBox='0 0 48 48'%3E%3Ccircle cx='24' cy='24' r='22' fill='%230b1220'/%3E%3Ccircle cx='24' cy='24' r='18' fill='none' stroke='%233b82f6' stroke-width='4'/%3E%3Cpath d='M14.5 17 24 34l9.5-17' fill='none' stroke='%23fff' stroke-width='4.6' stroke-linecap='round' stroke-linejoin='round'/%3E%3C/svg%3E">
      <link rel="preconnect" href="https://fonts.googleapis.com">
      <link rel="preconnect" href="https://fonts.gstatic.com" crossorigin>
  <!-- Critical theme bootstrap (ov-theme-boot) — MUST stay inline and above the stylesheets.
ddiff --git a/apps/yt/server/index.js b/apps/yt/server/index.js
iindex 1f52f3f..ac1d164 100644
---- a/apps/yt/server/index.js
++++ b/apps/yt/server/index.js
@@@ -39,11 +39,12 @@ app.use(helmet({
      contentSecurityPolicy: {
          directives: {
              defaultSrc: ["'self'"],
--            scriptSrc: ["'self'", "'unsafe-inline'", "https://cdnjs.cloudflare.com", "https://fonts.googleapis.com", "https://openvibe.network"],
++            scriptSrc: ["'self'", "'unsafe-inline'", "https://cdnjs.cloudflare.com", "https://fonts.googleapis.com", "https://openvibe.network", "https://static.cloudflareinsights.com"],
              styleSrc: ["'self'", "'unsafe-inline'", "https://cdnjs.cloudflare.com", "https://fonts.googleapis.com", "https://fonts.gstatic.com"],
              fontSrc: ["'self'", "https://fonts.gstatic.com", "https://cdnjs.cloudflare.com"],
--            imgSrc: ["'self'", "data:", "https://i.ytimg.com", "https://img.youtube.com", "https://*.ggpht.com"],
--            connectSrc: ["'self'", "https://openvibe.network", "https://*.openvibe.tools"],
++            imgSrc: ["'self'", "data:", "https://i.ytimg.com", "https://img.youtube.com", "https://*.ggpht.com", "https://openvibe.network", "https://openvibe.media"],
++            connectSrc: ["'self'", "https://openvibe.network", "https://openvibe.tools", "https://*.openvibe.tools", "https://cloudflareinsights.com"],
++            frameSrc: ["https://openvibe.network"], // the hidden /sso/check sign-in probe
              scriptSrcAttr: ["'unsafe-inline'"],
          },
      },
ddiff --git a/vendor/openvibe-shared/island.js b/vendor/openvibe-shared/island.js
iindex de206ee..2c3a418 100644
---- a/vendor/openvibe-shared/island.js
++++ b/vendor/openvibe-shared/island.js
@@@ -72,7 +72,8 @@
          pill = el('button', 'ovi-pill'); pill.type = 'button'; pill.setAttribute('aria-haspopup', 'true'); pill.setAttribute('aria-expanded', 'false');
          card = el('div', 'ovi-card'); card.setAttribute('role', 'region'); card.setAttribute('aria-label', 'Activity');
          host.append(pill, card);
--        const brand = document.querySelector('.openvibe-navbar .ovnav-brand, .openvibe-navbar .openvibe-brand, .navbar .nav-brand, .navbar .logo');
++        // Dock after the brand (and its launcher button); sites with their own navbar mark the spot with [data-ov-island].
++        const brand = document.querySelector('[data-ov-island], .openvibe-navbar #openvibe-launcher-btn, .openvibe-navbar .openvibe-navbar-brand, .navbar .nav-brand');
          if (brand && brand.parentNode) brand.parentNode.insertBefore(host, brand.nextSibling);
          else { host.classList.add('is-floating'); document.body.appendChild(host); }
          const open = (v) => { host.classList.toggle('is-open', v); pill.setAttribute('aria-expanded', String(v)); };
@@@ -86,7 +87,7 @@
  
      function brandMark(a) {
          // The navbar's own mark mirrors the top activity: progress ring + state colour.
--        document.querySelectorAll('.openvibe-navbar .ov-mark, .navbar .ov-mark').forEach((m) => {
++        document.querySelectorAll('.openvibe-navbar-brand .ov-mark, .navbar .nav-brand .ov-mark').forEach((m) => {
              if (m.closest('.openvibe-network-badge')) return;
              if (!a) { m.removeAttribute('data-state'); m.removeAttribute('data-progress'); m.style.removeProperty('--ovm-p'); return; }
              m.setAttribute('data-state', a.state === 'info' ? 'idle' : a.state);