Maps CSP: allow avatars from openvibe.media in img-src (#288)

ddiff --git a/apps/maps/server/index.js b/apps/maps/server/index.js
iindex c8aa59c..26b20b1 100644
---- a/apps/maps/server/index.js
++++ b/apps/maps/server/index.js
@@@ -80,7 +80,7 @@ app.use(helmet({
        defaultSrc: ["'self'"],
        scriptSrc: ["'self'", "'unsafe-inline'", "unpkg.com", "cdn.jsdelivr.net", "static.cloudflareinsights.com", "https://openvibe.network"],
        styleSrc: ["'self'", "'unsafe-inline'", "unpkg.com", "cdn.jsdelivr.net", "fonts.googleapis.com"],
--      imgSrc: ["'self'", "data:", "blob:", "*.tile.openstreetmap.org", "*.basemaps.cartocdn.com", "server.arcgisonline.com", "image.tmdb.org", "*.wp.com"],
++      imgSrc: ["'self'", "data:", "blob:", "*.tile.openstreetmap.org", "*.basemaps.cartocdn.com", "server.arcgisonline.com", "image.tmdb.org", "*.wp.com", "https://openvibe.media"],
        // openvibe.events: release notifications (release-watch's EventSource, openvibe-shared 2.13.0).
        // The navbar's Messages count asks Chat (openvibe-shared 4.130.0).
        connectSrc: ["'self'", "https://openvibe.chat", "nominatim.openstreetmap.org", "api.weather.gov", "api.open-meteo.com", "*.tile.openstreetmap.org", "*.basemaps.cartocdn.com", "server.arcgisonline.com", "https://openvibe.network", "https://openvibe.events", "https://cloudflareinsights.com"],
ddiff --git a/apps/maps/test/csp.test.js b/apps/maps/test/csp.test.js
nnew file mode 100644
iindex 0000000..3664932
---- /dev/null
++++ b/apps/maps/test/csp.test.js
@@@ -0,0 +1,17 @@
++'use strict';
++// Avatars are served from openvibe.media (the Network's /avatar/<name> redirects there). The survival
++// map shows people's avatars, so its Content-Security-Policy img-src must allow that origin.
++const assert = require('assert');
++const { startApp } = require('../../_shared/test/spawn');
++
++(async () => {
++    const maps = await startApp('maps', {}, undefined, { readyPath: '/api/ready' });
++    try {
++        const csp = (await fetch(`${maps.base}/`)).headers.get('content-security-policy') || '';
++        assert.match(csp, /img-src[^;]*https:\/\/openvibe\.media(?:[ ;]|$)/, csp);
++        console.log('  ✓ img-src allows https://openvibe.media');
++    } finally {
++        maps.kill('SIGTERM');
++        await maps.exited;
++    }
++})().catch((e) => { console.error(e); process.exitCode = 1; });