Media: a tours tenant for Tours' place photos (#359)

ddiff --git a/server/auth.js b/server/auth.js
iindex 643eaad..f7d233d 100644
---- a/server/auth.js
++++ b/server/auth.js
@@@ -214,6 +214,7 @@ async function ensureTokenOnlyApps() {
          ['media-hub', 'OpenVibe.MediaHub', 100, []],    // the OpenVibe.Download drive
          ['codes', 'OpenVibe.Codes', 5, []],          // a task's screenshots, private to the person (Codes #188, 10-30)
          ['host', 'OpenVibe.Host', 10, []],          // the screenshot baselines ovhost shots captures (plan L9, 11-06)
++        ['tours', 'OpenVibe.Tours', 5, ['https://openvibe.tours']],   // licensed place photos copied from Commons/Openverse (11-08)
      ]) {
          if (!await db.getApp(appId)) {
              await db.run("INSERT INTO apps (app_id, name, api_key_hash, quota_bytes, allowed_origins) VALUES (?, ?, '', ?, ?)", [appId, name, quotaGb * 1024 ** 3, JSON.stringify(origins)]);
ddiff --git a/test/app-tenants.test.js b/test/app-tenants.test.js
iindex 498b87e..8515637 100644
---- a/test/app-tenants.test.js
++++ b/test/app-tenants.test.js
@@@ -36,7 +36,7 @@ const crypto = require('crypto');
      await auth.ensureTokenOnlyApps();
      // C-71: every first-party tenant exists without seeding, and one boot created carries no app key. An existing row
      // (live, written with a test key just above) is left exactly as it was.
--    for (const id of ['community', 'tools', 'games', 'wiki', 'blog', 'inventory', 'media-hub', 'codes', 'host', 'locker']) {
++    for (const id of ['community', 'tools', 'games', 'wiki', 'blog', 'inventory', 'media-hub', 'codes', 'host', 'locker', 'tours']) {
          const row = await db.getApp(id);
          assert.ok(row, `${id} exists without seeding`);
          assert.strictEqual(row.api_key_hash, '', `${id} has no app key`);