Events moves to openvibe.events: connect-src, stream URLs and shared 2.13.0 in one change (plan T7) (#13)

ddiff --git a/README.md b/README.md
iindex 215c82e..3d26682 100644
---- a/README.md
++++ b/README.md
@@@ -62,7 +62,7 @@ transactions, not an authority for anything.
  - **OpenVibe.Network** — RS256 service and user tokens (JWKS), OAuth sign-in for the pages.
  - **OpenVibe.Events** — delivery of Billing's events to `/internal/events`; relay of VIP's outbox.
  - **PostgreSQL 18 and Valkey 9** (OpenVibe.Host `roles/data/`, ADR-035): every read and write is async through `openvibe-sdk/db`; Valkey holds the per-actor limit counters (optional).
--- **openvibe-contracts** v0.76.0, **openvibe-sdk** v0.20.1 (outbox, inbox, delivery signatures, per-actor
++- **openvibe-contracts** v0.76.0, **openvibe-sdk** v0.28.0 (outbox, inbox, delivery signatures, per-actor
    limits), **openvibe-shared** v2.2.0 (Frame, legal pages, release manifest and update metrics, metrics,
    readiness).
  - Consumers, through the client below: Chat (the member badge), Community (members-only spaces and
ddiff --git a/package-lock.json b/package-lock.json
iindex 31c7ee1..1a442f2 100644
---- a/package-lock.json
++++ b/package-lock.json
@@@ -16,7 +16,7 @@
          "jsonwebtoken": "^9.0.2",
          "openvibe-contracts": "https://codeload.github.com/OpenVibers/OpenVibe.Contracts/tar.gz/refs/tags/v0.92.0",
          "openvibe-sdk": "https://codeload.github.com/OpenVibers/OpenVibe.SDK/tar.gz/refs/tags/v0.28.0",
--        "openvibe-shared": "https://codeload.github.com/OpenVibers/OpenVibe.Shared/tar.gz/refs/tags/v2.12.0",
++        "openvibe-shared": "https://codeload.github.com/OpenVibers/OpenVibe.Shared/tar.gz/refs/tags/v2.13.0",
          "pg": "^8.23.0"
        },
        "devDependencies": {
@@@ -861,6 +861,7 @@
      "node_modules/openvibe-sdk": {
        "version": "0.28.0",
        "resolved": "https://codeload.github.com/OpenVibers/OpenVibe.SDK/tar.gz/refs/tags/v0.28.0",
++      "integrity": "sha512-jjLisFDWBN+xDVsixa5BJRr3355kRijmvOh1/9rz4s1yVb3wZWCbpTLNcOvXm57ksnRoqK57393W38G0Ey3PFw==",
        "license": "MIT",
        "engines": {
          "node": ">=20"
@@@ -887,9 +888,9 @@
        }
      },
      "node_modules/openvibe-shared": {
--      "version": "2.12.0",
--      "resolved": "https://codeload.github.com/OpenVibers/OpenVibe.Shared/tar.gz/refs/tags/v2.12.0",
--      "integrity": "sha512-GQpNFs2h61OKKNLexQwCfSJTLzNQ7fSbwqvrerB4oNdoxUgDvmdD43SELWycrb9DX8lkje4cR3ARznYIINnR8Q==",
++      "version": "2.13.0",
++      "resolved": "https://codeload.github.com/OpenVibers/OpenVibe.Shared/tar.gz/refs/tags/v2.13.0",
++      "integrity": "sha512-0Lvo+bBWVGWREkp92tY4cGI32ZO124WTOjthDNTB96U161odl+npnYEWy3dV2IcgZC4HAX5DSzx4ThgNS2V/sA==",
        "license": "MIT",
        "dependencies": {
          "jsonwebtoken": "^9.0.0"
ddiff --git a/package.json b/package.json
iindex 0a8c46a..1ea231a 100644
---- a/package.json
++++ b/package.json
@@@ -33,7 +33,7 @@
      "jsonwebtoken": "^9.0.2",
      "openvibe-contracts": "https://codeload.github.com/OpenVibers/OpenVibe.Contracts/tar.gz/refs/tags/v0.92.0",
      "openvibe-sdk": "https://codeload.github.com/OpenVibers/OpenVibe.SDK/tar.gz/refs/tags/v0.28.0",
--    "openvibe-shared": "https://codeload.github.com/OpenVibers/OpenVibe.Shared/tar.gz/refs/tags/v2.12.0",
++    "openvibe-shared": "https://codeload.github.com/OpenVibers/OpenVibe.Shared/tar.gz/refs/tags/v2.13.0",
      "pg": "^8.23.0"
    },
    "engines": {
ddiff --git a/server/app.js b/server/app.js
iindex 85552d4..4aac15e 100644
---- a/server/app.js
++++ b/server/app.js
@@@ -84,10 +84,10 @@ async function createApp(opts = {}) {
      app.use((req, res, next) => {
          res.setHeader('X-Content-Type-Options', 'nosniff');
          res.setHeader('Referrer-Policy', 'strict-origin-when-cross-origin');
--        // connect-src events.openvibe.network: release notifications (release-watch's EventSource, openvibe-shared 1.17).
++        // connect-src openvibe.events: release notifications (release-watch's EventSource, openvibe-shared 1.17).
          res.setHeader('Content-Security-Policy', [
              "default-src 'self'", "script-src 'self' 'unsafe-inline' https://openvibe.network", "style-src 'self' 'unsafe-inline' https://openvibe.network",
--            "img-src 'self' data: https:", "connect-src 'self' https://openvibe.network https://events.openvibe.network", "frame-src 'self' https://openvibe.network",
++            "img-src 'self' data: https:", "connect-src 'self' https://openvibe.network https://openvibe.events", "frame-src 'self' https://openvibe.network",
              "frame-ancestors 'self'", "object-src 'none'", "base-uri 'self'", "form-action 'self' https://openvibe.network https:",
          ].join('; '));
          next();