v0.24.0: OpenVibe.Host Stage B (host.site.manage, host.deploy.create, host.domain.manage)

ddiff --git a/manifests/capabilities/host.deploy.create.json b/manifests/capabilities/host.deploy.create.json
nnew file mode 100644
iindex 00000000..4e39d44c
---- /dev/null
++++ b/manifests/capabilities/host.deploy.create.json
@@@ -0,0 +1,28 @@
++{
++  "id": "host.deploy.create",
++  "version": "1.0",
++  "owner": "host",
++  "status": "active",
++  "visibility": "first-party",
++  "description": "Upload an immutable static deploy (tar/tar.gz or multipart files; validated for path traversal, links, special and hidden files, server-side code, file types and quotas; never executed), list deploys and their upload logs, activate a deploy and roll a site back to any earlier ready deploy (one atomic pointer switch). Also judged by the acting principal's project role (deployer or above); an app principal added to a project as deployer can deploy from CI.",
++  "permissions": [
++    "host:deploy"
++  ],
++  "resourceConstraints": [
++    "project"
++  ],
++  "quotaClass": "host-deploy",
++  "events": [
++    "host.deploy.created",
++    "host.deploy.activated",
++    "host.deploy.failed"
++  ],
++  "implementedBy": [
++    "GET /api/v1/sites/:id/deploys",
++    "POST /api/v1/sites/:id/deploys",
++    "GET /api/v1/deploys/:id",
++    "GET /api/v1/deploys/:id/log",
++    "POST /api/v1/deploys/:id/activate",
++    "POST /api/v1/sites/:id/rollback"
++  ]
++}
ddiff --git a/manifests/capabilities/host.domain.manage.json b/manifests/capabilities/host.domain.manage.json
nnew file mode 100644
iindex 00000000..39087d1d
---- /dev/null
++++ b/manifests/capabilities/host.domain.manage.json
@@@ -0,0 +1,24 @@
++{
++  "id": "host.domain.manage",
++  "version": "1.0",
++  "owner": "host",
++  "status": "active",
++  "visibility": "first-party",
++  "description": "Add a custom domain to a static site (never an OpenVibe domain; not in sandbox projects), read its DNS TXT verification and routing records, trigger a verification check, and remove it. A custom domain is served only after its TXT record is verified; TLS certificates are issued by an operator and never pass through this capability.",
++  "permissions": [
++    "host:write"
++  ],
++  "resourceConstraints": [
++    "project"
++  ],
++  "quotaClass": "host-manage",
++  "events": [
++    "host.domain.verified"
++  ],
++  "implementedBy": [
++    "GET /api/v1/sites/:id/domains",
++    "POST /api/v1/sites/:id/domains",
++    "POST /api/v1/domains/:id/verify",
++    "DELETE /api/v1/domains/:id"
++  ]
++}
ddiff --git a/manifests/capabilities/host.site.manage.json b/manifests/capabilities/host.site.manage.json
nnew file mode 100644
iindex 00000000..1cbb094b
---- /dev/null
++++ b/manifests/capabilities/host.site.manage.json
@@@ -0,0 +1,31 @@
++{
++  "id": "host.site.manage",
++  "version": "1.0",
++  "owner": "host",
++  "status": "active",
++  "visibility": "first-party",
++  "description": "Manage OpenVibe.Host tenant projects and static sites: create a project (owned by the person named with X-OV-Subject; apps cannot own projects), read projects, quotas and usage, manage members (owner role), create and delete sites, delete a deploy that is not active. Also judged by the acting principal's project role; a sandbox token (env=sandbox) is refused on production projects. Quota changes additionally need a Network staff user.",
++  "permissions": [
++    "host:write"
++  ],
++  "resourceConstraints": [
++    "project"
++  ],
++  "quotaClass": "host-manage",
++  "events": [],
++  "implementedBy": [
++    "GET /api/v1/projects",
++    "POST /api/v1/projects",
++    "GET /api/v1/projects/:id",
++    "DELETE /api/v1/projects/:id",
++    "GET /api/v1/projects/:id/quota",
++    "PUT /api/v1/projects/:id/quota",
++    "PUT /api/v1/projects/:id/members/:principal",
++    "DELETE /api/v1/projects/:id/members/:principal",
++    "GET /api/v1/projects/:id/sites",
++    "POST /api/v1/projects/:id/sites",
++    "GET /api/v1/sites/:id",
++    "DELETE /api/v1/sites/:id",
++    "DELETE /api/v1/deploys/:id"
++  ]
++}
ddiff --git a/manifests/services/host.json b/manifests/services/host.json
iindex 247914f4..82426482 100644
---- a/manifests/services/host.json
++++ b/manifests/services/host.json
@@@ -1,18 +1,32 @@
  {
--  "version": "0.1.0",
++  "version": "0.2.0",
    "contractRanges": {
--    "openvibe-contracts": ">=0.7.0 <1.0.0"
++    "openvibe-contracts": ">=0.10.0 <1.0.0"
    },
    "id": "host",
    "name": "OpenVibe.Host",
    "status": "alpha",
    "repository": "OpenVibers/OpenVibe.Host",
--  "domains": [],
--  "capabilities": [],
--  "eventsProduced": [],
++  "domains": [
++    "openvibe.host"
++  ],
++  "publicOrigin": "https://openvibe.host",
++  "health": "/api/health",
++  "ready": "/api/ready",
++  "capabilities": [
++    "host.site.manage",
++    "host.deploy.create",
++    "host.domain.manage"
++  ],
++  "eventsProduced": [
++    "host.deploy.created",
++    "host.deploy.activated",
++    "host.deploy.failed",
++    "host.domain.verified"
++  ],
    "eventsConsumed": [],
    "namespacesOwned": [
      "host.*"
    ],
--  "notes": "Stage A operator plane only: the ovhost CLI, run by an operator on the host (validate, plan, deploy with protected-session guards, automatic rollback, status, certificate inventory, vhost rendering, config snapshots, SQLite backups). No server and no public API yet; port 4910 is reserved for the later operator API. Stages B (tenant static hosting) and C (sandboxed user code) are not started."
++  "notes": "Stage A: the ovhost operator CLI (no server). Stage B: the Host API service on port 4910 (unit openvibe-host.service, state /var/lib/openvibe-host-api): tenant projects keyed by project id (prj_, network_project_id once Network has projects, ADR-014), static sites served by Host header at <site>.openvibe.host (a registrable domain separate from every other OpenVibe domain) and on TXT-verified custom domains, immutable content-addressed deploys with rollback, quotas enforced here, upload logs. Consumes OpenVibe.Network (SSO, JWKS, client-credentials) and publishes through OpenVibe.Events (events.event.publish). Stage C (sandboxed user code) is not started."
  }
ddiff --git a/package.json b/package.json
iindex 6158270b..c110e96e 100644
---- a/package.json
++++ b/package.json
@@@ -1,6 +1,6 @@
  {
    "name": "openvibe-contracts",
--  "version": "0.23.0",
++  "version": "0.24.0",
    "description": "Machine-readable contracts for the OpenVibe network: schemas, manifests, ids, error envelope, capability checks.",
    "main": "index.js",
    "types": "generated/typescript/index.d.ts",