Events moves to openvibe.events: connect-src, stream URLs and shared 2.13.0 / sdk 0.35.0 in one change (plan T7) (#13)

ddiff --git a/README.md b/README.md
iindex d3db8a7..fac7d24 100644
---- a/README.md
++++ b/README.md
@@@ -281,8 +281,8 @@ Production: `/opt/openvibe.wiki`, env `/etc/openvibe/wiki.env`, unit
  - PostgreSQL 18 and Valkey 9 (OpenVibe.Host `roles/data/`, ADR-035): every read and write is async through
    `openvibe-sdk/db`; Valkey holds the per-actor limit counters (optional: without `VALKEY_URL` they count per process).
  - `openvibe-publishing` v1.3.0 (async PostgreSQL stores, ingest and publication chassis), `openvibe-contracts`
--  v0.107.0, `openvibe-shared` v2.12.0
--  (Frame, release, metrics, readiness, SEO helpers, legal pages), `openvibe-sdk` v0.34.0 (db, auth, PostgreSQL
++  v0.107.0, `openvibe-shared` v2.13.0
++  (Frame, release, metrics, readiness, SEO helpers, legal pages), `openvibe-sdk` v0.35.0 (db, auth, PostgreSQL
    events outbox, per-actor limits, testing) — pinned release tarballs.
  - OpenVibe.Network (SSO, JWKS, service principal `wiki`), OpenVibe.Events, OpenVibe.Community,
    OpenVibe.Sources, OpenVibe.Media, OpenVibe.VIP (VIP spaces and pages), OpenVibe.Search (consumer of
ddiff --git a/STATUS.json b/STATUS.json
iindex 0cd33c2..ff02daf 100644
---- a/STATUS.json
++++ b/STATUS.json
@@@ -10,8 +10,8 @@
    "contracts": "openvibe-contracts v0.107.0",
    "packages": [
      "openvibe-publishing v1.3.0",
--    "openvibe-shared v2.12.0",
--    "openvibe-sdk v0.34.0"
++    "openvibe-shared v2.13.0",
++    "openvibe-sdk v0.35.0"
    ],
    "capabilities": [
      "wiki.space.create",
ddiff --git a/package-lock.json b/package-lock.json
iindex 3588e46..3051e46 100644
---- a/package-lock.json
++++ b/package-lock.json
@@@ -16,8 +16,8 @@
          "iovalkey": "^0.4.0",
          "openvibe-contracts": "https://codeload.github.com/OpenVibers/OpenVibe.Contracts/tar.gz/refs/tags/v0.107.0",
          "openvibe-publishing": "https://codeload.github.com/OpenVibers/OpenVibe.Publishing/tar.gz/refs/tags/v1.3.0",
--        "openvibe-sdk": "https://codeload.github.com/OpenVibers/OpenVibe.SDK/tar.gz/refs/tags/v0.34.0",
--        "openvibe-shared": "https://codeload.github.com/OpenVibers/OpenVibe.Shared/tar.gz/refs/tags/v2.12.0",
++        "openvibe-sdk": "https://codeload.github.com/OpenVibers/OpenVibe.SDK/tar.gz/refs/tags/v0.35.0",
++        "openvibe-shared": "https://codeload.github.com/OpenVibers/OpenVibe.Shared/tar.gz/refs/tags/v2.13.0",
          "pg": "^8.23.0"
        },
        "devDependencies": {
@@@ -893,9 +893,9 @@
        }
      },
      "node_modules/openvibe-sdk": {
--      "version": "0.34.0",
--      "resolved": "https://codeload.github.com/OpenVibers/OpenVibe.SDK/tar.gz/refs/tags/v0.34.0",
--      "integrity": "sha512-vDwnDV1e2xbWqShjTr4p6sNehoUAQwW8RyQKrwvoqX1pJbxks86u2DjF9LGSlAoAdMZhmJbgVaAEm0r18Qmt5g==",
++      "version": "0.35.0",
++      "resolved": "https://codeload.github.com/OpenVibers/OpenVibe.SDK/tar.gz/refs/tags/v0.35.0",
++      "integrity": "sha512-IF7XB97tU7Q+ccwssGx6QXXcfDPcVpl+mX3BjIr7C6NJlcmoqj9DbHiKrBxlVav0eG44Jf8zuXEwokrHDq3J0w==",
        "license": "MIT",
        "engines": {
          "node": ">=20"
@@@ -922,9 +922,9 @@
        }
      },
      "node_modules/openvibe-shared": {
--      "version": "2.12.0",
--      "resolved": "https://codeload.github.com/OpenVibers/OpenVibe.Shared/tar.gz/refs/tags/v2.12.0",
--      "integrity": "sha512-GQpNFs2h61OKKNLexQwCfSJTLzNQ7fSbwqvrerB4oNdoxUgDvmdD43SELWycrb9DX8lkje4cR3ARznYIINnR8Q==",
++      "version": "2.13.0",
++      "resolved": "https://codeload.github.com/OpenVibers/OpenVibe.Shared/tar.gz/refs/tags/v2.13.0",
++      "integrity": "sha512-0Lvo+bBWVGWREkp92tY4cGI32ZO124WTOjthDNTB96U161odl+npnYEWy3dV2IcgZC4HAX5DSzx4ThgNS2V/sA==",
        "license": "MIT",
        "dependencies": {
          "jsonwebtoken": "^9.0.0"
ddiff --git a/package.json b/package.json
iindex be2abc2..1c35234 100644
---- a/package.json
++++ b/package.json
@@@ -27,8 +27,8 @@
      "iovalkey": "^0.4.0",
      "openvibe-contracts": "https://codeload.github.com/OpenVibers/OpenVibe.Contracts/tar.gz/refs/tags/v0.107.0",
      "openvibe-publishing": "https://codeload.github.com/OpenVibers/OpenVibe.Publishing/tar.gz/refs/tags/v1.3.0",
--    "openvibe-sdk": "https://codeload.github.com/OpenVibers/OpenVibe.SDK/tar.gz/refs/tags/v0.34.0",
--    "openvibe-shared": "https://codeload.github.com/OpenVibers/OpenVibe.Shared/tar.gz/refs/tags/v2.12.0",
++    "openvibe-sdk": "https://codeload.github.com/OpenVibers/OpenVibe.SDK/tar.gz/refs/tags/v0.35.0",
++    "openvibe-shared": "https://codeload.github.com/OpenVibers/OpenVibe.Shared/tar.gz/refs/tags/v2.13.0",
      "pg": "^8.23.0"
    },
    "engines": {
ddiff --git a/seeds/openvibe.json b/seeds/openvibe.json
iindex 45886f4..cf9d9fc 100644
---- a/seeds/openvibe.json
++++ b/seeds/openvibe.json
@@@ -236,7 +236,7 @@
      {
        "title": "OpenVibe.Events",
        "parent": "OpenVibe",
--      "body": "**OpenVibe.Events** provides \"durable events, subscriptions, delivery, retry, dead letters and replay for the network\". Its README gives the status as **alpha** (roadmap Wave 3): it \"runs and is tested; no service publishes to it in production yet\". Its STATUS.json records it as not deployed. The README names `events.openvibe.network` as its domain and states that the domain keeps its placeholder page on OpenVibe.Sites until the plan's launch rule holds.\n\n## Purpose\n\nThe README calls it \"the durable event backbone the network does not have yet\". Authoritative services write domain changes and outbox events in one transaction, a relay publishes them to Events, consumers use inbox and idempotency receipts, and browsers receive authorized, resumable projections through a Realtime delivery plane. It is meant to replace the best-effort internal POSTs and webhooks between [[OpenVibe.Live]], [[OpenVibe.Media]], [[OpenVibe.Network]] and [[OpenVibe.Community]]. The first planned migrations are notifications, then Media ready/failed, then stream lifecycle.\n\n## What it owns\n\n- the event, subscription, delivery, checkpoint and idempotency-receipt tables, in SQLite today;\n- the canonical event envelope;\n- priority classes, loop guards, backpressure, the dead-letter queue and replay;\n- Realtime over Server-Sent Events, with cursor resume and gap detection; WebSocket and presence are not built yet.\n\nDelivery is at least once and not strictly ordered. A failed delivery is retried up to 8 attempts and is then marked dead. The `openvibe-events` client library provides a transactional outbox for producers and an inbox for consumers.\n\n## What it does not own\n\nMedia bytes, game or media transport packets, and product business rules.\n\n## Dependencies\n\nOpenVibe.Contracts and [[OpenVibe.Network]]; services call Events with Network client-credentials tokens. STATUS.json gives the runtime as Node 22, Express and better-sqlite3 on port 4300. The license is AGPL-3.0.\n",
++      "body": "**OpenVibe.Events** provides \"durable events, subscriptions, delivery, retry, dead letters and replay for the network\". Its README gives the status as **alpha** (roadmap Wave 3): it \"runs and is tested; no service publishes to it in production yet\". Its STATUS.json records it as not deployed. The README names `openvibe.events` as its domain and states that the domain keeps its placeholder page on OpenVibe.Sites until the plan's launch rule holds.\n\n## Purpose\n\nThe README calls it \"the durable event backbone the network does not have yet\". Authoritative services write domain changes and outbox events in one transaction, a relay publishes them to Events, consumers use inbox and idempotency receipts, and browsers receive authorized, resumable projections through a Realtime delivery plane. It is meant to replace the best-effort internal POSTs and webhooks between [[OpenVibe.Live]], [[OpenVibe.Media]], [[OpenVibe.Network]] and [[OpenVibe.Community]]. The first planned migrations are notifications, then Media ready/failed, then stream lifecycle.\n\n## What it owns\n\n- the event, subscription, delivery, checkpoint and idempotency-receipt tables, in SQLite today;\n- the canonical event envelope;\n- priority classes, loop guards, backpressure, the dead-letter queue and replay;\n- Realtime over Server-Sent Events, with cursor resume and gap detection; WebSocket and presence are not built yet.\n\nDelivery is at least once and not strictly ordered. A failed delivery is retried up to 8 attempts and is then marked dead. The `openvibe-events` client library provides a transactional outbox for producers and an inbox for consumers.\n\n## What it does not own\n\nMedia bytes, game or media transport packets, and product business rules.\n\n## Dependencies\n\nOpenVibe.Contracts and [[OpenVibe.Network]]; services call Events with Network client-credentials tokens. STATUS.json gives the runtime as Node 22, Express and better-sqlite3 on port 4300. The license is AGPL-3.0.\n",
        "summary": "Durable event backbone for the OpenVibe network; alpha and not deployed at the cited commit.",
        "infobox": [
          {
@@@ -261,7 +261,7 @@
            "key": "domain",
            "label": "Domain",
            "type": "text",
--          "value": "events.openvibe.network"
++          "value": "openvibe.events"
          },
          {
            "key": "port",
ddiff --git a/server/app.js b/server/app.js
iindex c0e2bdd..47a6880 100644
---- a/server/app.js
++++ b/server/app.js
@@@ -51,8 +51,8 @@ function createApp({ config, svc, viewers: baseViewers, platform, keys, db, valk
              "style-src 'self' 'unsafe-inline' https://openvibe.network https://fonts.googleapis.com https://cdnjs.cloudflare.com",
              "font-src 'self' data: https://fonts.gstatic.com https://cdnjs.cloudflare.com",
              "img-src 'self' data: https:",
--            // events.openvibe.network: release notifications (release-watch's EventSource, openvibe-shared 1.17).
--            "connect-src 'self' https://openvibe.network https://cloudflareinsights.com https://events.openvibe.network",
++            // openvibe.events: release notifications (release-watch's EventSource, openvibe-shared 1.17).
++            "connect-src 'self' https://openvibe.network https://cloudflareinsights.com https://openvibe.events",
              "frame-src 'self' https://openvibe.network",
              "frame-ancestors 'self'",
              "form-action 'self' https://openvibe.network",