Media: the AI tenant for the shared image task (#382)

ddiff --git a/CHANGELOG.md b/CHANGELOG.md
iindex 72915c6..82de73c 100644
---- a/CHANGELOG.md
++++ b/CHANGELOG.md
@@@ -2,6 +2,10 @@
  
  ## Unreleased
  
++- A first-party `ai` tenant for OpenVibe.AI's shared image task (`image.picture`): found Commons/Openverse pictures
++  and made illustrations are stored by Media reference in the blog or wiki tenant for the person the run acts for.
++  Network grants AI `media.object.upload` there (the AI, blog and wiki namespaces). `server/auth.js`.
++
  - **Watch ids (plan track U, 2026-11-07): every VOD and clip answers to an 11-character random id.** YouTube's
    `/watch?v=` shape, so a watch page cannot be found by counting: 8 random bytes as URL-safe base64
    (`crypto.randomBytes(8).toString('base64url')`), never derived from the numeric id. Media owns VODs and clips, so
ddiff --git a/server/auth.js b/server/auth.js
iindex f7d233d..09874a8 100644
---- a/server/auth.js
++++ b/server/auth.js
@@@ -210,6 +210,7 @@ async function ensureTokenOnlyApps() {
          ['games', 'OpenVibe.Games', 10, ['https://openvibe.games', 'https://play.openvibe.games']],   // Wave 12 map-editor assets
          ['wiki', 'OpenVibe.Wiki', 10, []],         // Wave 16 page attachments
          ['blog', 'OpenVibe.Blog', 10, []],         // Wave 16 post attachments
++        ['ai', 'OpenVibe.AI', 10, []],              // the shared image task's find/make pictures (rich-content §4/§5)
          ['inventory', 'OpenVibe.Inventory', 1, []],     // Workshop badge images
          ['media-hub', 'OpenVibe.MediaHub', 100, []],    // the OpenVibe.Download drive
          ['codes', 'OpenVibe.Codes', 5, []],          // a task's screenshots, private to the person (Codes #188, 10-30)