nginx: /auth/me, the session probe the shared navbar asks on every page view, gets its own location on the API zone (burst 30) instead of the sign-in zone (10 a minute, burst 10), and both answer 429 when limited instead of nginx's default 503. The browser check (Host scripts/browser-check.js, WS-Q task 3) saw /auth/me answer 503 after about ten quick page loads, which the navbar takes as signed out. test/nginx-auth-limit.test.js. Takes effect when the vhost is next installed (not deployed here)

ddiff --git a/deploy/nginx/openvibe.blog.conf b/deploy/nginx/openvibe.blog.conf
iindex affd097..65e4276 100644
---- a/deploy/nginx/openvibe.blog.conf
++++ b/deploy/nginx/openvibe.blog.conf
@@@ -72,8 +72,18 @@ server {
      proxy_set_header X-Forwarded-Proto $scheme;
  
      # ── Network SSO session endpoints (strict) ──────────────
++    # The session probe: the shared navbar asks it on every page view, so it cannot share the sign-in
++    # budget below (10 a minute): a visitor reading quickly was answered 503 and looked signed out
++    # (found by the browser check, OpenVibe.Host scripts/browser-check.js).
++    location = /auth/me {
++        limit_req zone=ovblog_api burst=30 nodelay;
++        limit_req_status 429;
++        proxy_pass http://127.0.0.1:4810;
++    }
++
      location /auth/ {
          limit_req zone=ovblog_auth burst=10 nodelay;
++        limit_req_status 429;
          proxy_pass http://127.0.0.1:4810;
      }
  
ddiff --git a/test/nginx-auth-limit.test.js b/test/nginx-auth-limit.test.js
nnew file mode 100644
iindex 0000000..4f50e80
---- /dev/null
++++ b/test/nginx-auth-limit.test.js
@@@ -0,0 +1,20 @@
++'use strict';
++// deploy/nginx/openvibe.blog.conf: the shared navbar asks /auth/me on every page view, so the session probe has its own location on
++// the API zone; the sign-in routes keep the strict zone (10 a minute). Both answer 429 when limited, not
++// nginx's default 503 (the browser check, OpenVibe.Host scripts/browser-check.js, found /auth/me answering
++// 503 after about ten quick page loads, which the navbar reads as signed out).
++const assert = require('assert');
++const fs = require('fs');
++const path = require('path');
++
++const conf = fs.readFileSync(path.join(__dirname, '..', ...'deploy/nginx/openvibe.blog.conf'.split('/')), 'utf8');
++const block = (loc) => { const m = conf.match(new RegExp(`\\n    location ${loc} \\{\\n([\\s\\S]*?)\\n    \\}`)); return m && m[1]; };
++const probe = block('= /auth/me'), auth = block('/auth/');
++assert.ok(probe && auth, 'both locations');
++assert.ok(conf.indexOf('location = /auth/me') < conf.indexOf('location /auth/ {'));
++assert.match(probe, /limit_req zone=ovblog_api burst=30 nodelay;/);
++assert.match(auth, /limit_req zone=ovblog_auth burst=10 nodelay;/);
++for (const b of [probe, auth]) assert.match(b, /limit_req_status 429;/);
++const upstream = (b) => (b.match(/proxy_pass (\S+);/) || [])[1];
++assert.ok(upstream(probe) && upstream(probe) === upstream(auth), 'the same upstream');
++console.log('nginx auth limit: /auth/me on the API zone, 429 when limited');