Actor may tell a task's owner that their agent needs them (identity.subject.resolve, network.notifications.push as app actor): Desks plan D4, hand it to me (#354)

ddiff --git a/server/identity/principals.js b/server/identity/principals.js
iindex dea81b72..13ea7207 100644
---- a/server/identity/principals.js
++++ b/server/identity/principals.js
@@@ -286,6 +286,11 @@ const DEFAULT_GRANTS = [
      // Each run is a chat you can open (consumer plan §4): Actor posts each passed run of a person's agent into their own
      // Vibe chat named after it (POST /internal/chat/vibe/deliver), while the agent's send_to_vibe is on.
      ['actor', 'chat.vibe.deliver', 'openvibe.chat', []],
++    // Desks plan D4, "hand it to me": when an agent needs its person for a step on its desk (a sign-in, a code, a
++    // CAPTCHA), Actor tells them wherever they are, with the link to take the desk over. Actor resolves the task's
++    // owner (a usr_ subject) to Network's user id, then pushes as app 'actor'.
++    ['actor', 'identity.subject.resolve', SELF_AUDIENCE, []],
++    ['actor', 'network.notifications.push', SELF_AUDIENCE, ['actor']],
      // Plan T18: OpenVibe.Watch relays watch.observation.recorded / watch.watch.triggered / watch.check.failed.
      ['watch', 'events.event.publish', 'openvibe.events', []],
      // Plan T18 step 4: a watch's notification action tells its owner when the condition fires. Watch resolves the owner
ddiff --git a/test/actor-notify-grants.test.js b/test/actor-notify-grants.test.js
nnew file mode 100644
iindex 00000000..b01886d7
---- /dev/null
++++ b/test/actor-notify-grants.test.js
@@@ -0,0 +1,21 @@
++/**
++ * OpenVibe.Actor's notification grants (Desks plan D4, "hand it to me"): when an agent needs its person for a step on
++ * its desk, Actor resolves the task's owner and pushes them a notification as app 'actor', and holds nothing else of
++ * Network's notifications. Each is a capability the pinned contracts offer, active.
++ *
++ *   node test/actor-notify-grants.test.js
++ */
++'use strict';
++const assert = require('assert');
++const contracts = require('openvibe-contracts');
++const principals = require('../server/identity/principals');
++
++const rows = principals.DEFAULT_GRANTS.filter((g) => g[0] === 'actor' && g[2] === principals.SELF_AUDIENCE);
++const held = new Map(rows.map((g) => [g[1], g[3]]));
++assert.ok(held.has('identity.subject.resolve'), 'actor resolves the task owner');
++assert.deepStrictEqual(held.get('network.notifications.push'), ['actor'], 'actor pushes as its own app only');
++for (const g of rows) {
++    const cap = contracts.capabilities.get(g[1]);
++    assert.ok(cap && cap.status === 'active', `${g[1]} is an active capability`);
++}
++console.log(`actor notify grants: ${rows.length}`);