Network: Host subscribes to the account events (the console keeps people's sealed hosting tokens, benchmarks their submissions); its export part and deletion grants follow once its subscriptions answer (#284)

ddiff --git a/server/identity/principals.js b/server/identity/principals.js
iindex 4388ff70..300d099e 100644
---- a/server/identity/principals.js
++++ b/server/identity/principals.js
@@@ -222,6 +222,9 @@ const DEFAULT_GRANTS = [
      ['coupons', 'events.subscription.manage', 'openvibe.events', []],
      ['coupons', 'sources.item.read', 'openvibe.sources', []],
      ['host', 'events.event.publish', 'openvibe.events', []],
++    // The console (Host#120, 2026-10-19) keeps people's sealed hosting tokens and their actions, and benchmarks (Host#117)
++    // their submissions: Host subscribes to the two account events first (its export part and deletion grants follow).
++    ['host', 'events.subscription.manage', 'openvibe.events', []],
      // T20 step 2 (2026-10-12, Space#36): the static hosting engine moved to Space, which publishes space.deploy.* and
      // space.domain.verified through its outbox. (Its forum-era grants stay revoked below.)
      ['space', 'events.event.publish', 'openvibe.events', []],
ddiff --git a/test/principals.test.js b/test/principals.test.js
iindex 9a60c61b..b3984f8c 100644
---- a/test/principals.test.js
++++ b/test/principals.test.js
@@@ -233,6 +233,11 @@ const server = http.createServer(app);
      const cps = await token({ client_id: 'coupons', client_secret: 'coupons-secret', audience: 'openvibe.events', scope: 'events.subscription.manage' });
      assert.strictEqual(cps.status, 200, JSON.stringify(cps.body));
      assert.strictEqual(cps.body.scope, 'events.subscription.manage', 'Coupons manages its Events subscriptions');
++    // Host subscribes to the account events (Host#120: the console's sealed tokens, benchmarks' submissions).
++    await db.prepare("UPDATE oauth_clients SET client_secret = 'host-secret' WHERE client_id = 'host'").run();
++    const hs = await token({ client_id: 'host', client_secret: 'host-secret', audience: 'openvibe.events', scope: 'events.subscription.manage' });
++    assert.strictEqual(hs.status, 200, JSON.stringify(hs.body));
++    assert.strictEqual(hs.body.scope, 'events.subscription.manage');
      // Plan T5 (Wave 9): Tips' chat adapter mints a token for 'chat.message.send chat.event.publish' on
      // openvibe.chat with its own service token (OpenVibe.Tips server/delivery/chat.js); without both rows
      // TIPS_CHAT_ADAPTER=chat can never deliver a paid effect.