OpenRe.Stream (Wave 7): client redirect, Live's stream/key/session grants, openre publishes events

ddiff --git a/server/db/database.js b/server/db/database.js
iindex c360f62c..6d4bfe7b 100644
---- a/server/db/database.js
++++ b/server/db/database.js
@@@ -587,6 +587,7 @@ function initDb(dbPath) {
              { client_id: 'vip', name: 'OpenVibe.VIP', redirect_uris: ['https://openvibe.vip/auth/callback'] },
              { client_id: 'wiki', name: 'OpenVibe.Wiki', redirect_uris: ['https://openvibe.wiki/auth/callback'] },
              { client_id: 'blog', name: 'OpenVibe.Blog', redirect_uris: ['https://openvibe.blog/auth/callback'] },
++            { client_id: 'openre', name: 'OpenRe.Stream', redirect_uris: ['https://openre.stream/auth/callback'] },
          ];
          const insert = db.prepare(
              'INSERT INTO oauth_clients (client_id, client_secret, name, redirect_uris, is_first_party) VALUES (?, ?, ?, ?, 1)'
ddiff --git a/server/identity/principals.js b/server/identity/principals.js
iindex 4ecdfda2..6828d099 100644
---- a/server/identity/principals.js
++++ b/server/identity/principals.js
@@@ -45,6 +45,10 @@ const DEFAULT_GRANTS = [
      ['tips', 'identity.subject.resolve', SELF_AUDIENCE, []],
      ['tips', 'live.tips_delivery.write', 'openvibe.live', []],
      ['live', 'tips.interaction.record', 'openvibe.tips', []],
++    // Wave 7: Live manages its slots' streams, keys and sessions on OpenRe.Stream; OpenRe publishes
++    // session/output events (Live consumes openre.session.* by webhook).
++    ...['openre.stream.read', 'openre.stream.write', 'openre.key.rotate', 'openre.session.read'].map(c => ['live', c, 'openvibe.openre', []]),
++    ['openre', 'events.event.publish', 'openvibe.events', []],
      // Wave 3: producers publish to OpenVibe.Events (their own source only, enforced by Events).
      ...['live', 'media', 'network', 'community', 'billing', 'chat', 'tools', 'games', 'search', 'sources', 'tips'].map(c => [c, 'events.event.publish', 'openvibe.events', []]),
      // Wave 14: Search subscribes to <owner>.index_document.* deliveries.