Report and Design may publish their Search documents (#522)

ddiff --git a/server/identity/principals.js b/server/identity/principals.js
iindex 586d8084..06c7cc38 100644
---- a/server/identity/principals.js
++++ b/server/identity/principals.js
@@@ -665,9 +665,14 @@ const DEFAULT_GRANTS = [
      ['report', 'billing.stats.read', 'openvibe.billing', []],
      ['report', 'billing.balance.read', 'openvibe.billing', []],
      ['report', 'events.subscription.manage', 'openvibe.events', []],
++    // Report publishes its Rundown topic pages to OpenVibe.Search as report.index_document.* (contracts 0.275.0,
++    // through its own outbox and openvibe-publishing/search-feed).
++    ['report', 'events.event.publish', 'openvibe.events', []],
      // OpenVibe.Design's Arena runs Vision's UI check (contracts 0.235.0 vision.ui.check, first-party). Vision 0.1.0's
      // source still labels the route's guard vision.ui_check; its service must use the contract id before Arena calls it.
      ['design', 'vision.ui.check', 'openvibe.vision', []],
++    // Design publishes its icon and theme pages to OpenVibe.Search as design.index_document.* (contracts 0.275.0).
++    ['design', 'events.event.publish', 'openvibe.events', []],
      ['design', 'ai.run.create', 'openvibe.ai', ['ai.generate']],
      // OpenVibe.Bench (contracts 0.238.0): the shared benchmark engine calls AI's generate route (namespace ai.generate)
      // to run its pinned rounds, and subscribes to the account events at boot; its export/deletion pair is with the
ddiff --git a/test/principals.test.js b/test/principals.test.js
iindex 2b7576b2..e6988461 100644
---- a/test/principals.test.js
++++ b/test/principals.test.js
@@@ -176,7 +176,8 @@ const server = http.createServer(app);
      t = await token({ client_id: 'report', client_secret: 'report-secret', audience: 'openvibe.billing' });
      assert.deepStrictEqual(t.body.scope.split(' '), ['billing.balance.read', 'billing.stats.read'], 'Report reads Billing\'s stats and per-subject balance');
      t = await token({ client_id: 'report', client_secret: 'report-secret', audience: 'openvibe.events' });
--    assert.strictEqual(t.body.scope, 'events.subscription.manage', 'Report subscribes to stream-ended and frame beacons');
++    // It also publishes its Rundown topic pages to Search as report.index_document.* (contracts 0.275.0).
++    assert.deepStrictEqual(t.body.scope.split(' ').sort(), ['events.event.publish', 'events.subscription.manage'], 'Report subscribes to stream-ended and frame beacons, and publishes its topic pages');
      t = await token({ client_id: 'report', client_secret: 'report-secret', audience: 'openvibe.network' });
      assert.strictEqual(t.status, 400, 'Report keeps nothing about people, so no account export or deletion grant');
      await db.prepare("UPDATE oauth_clients SET client_secret = 'design-secret' WHERE client_id = 'design'").run();