Serve the existing Bot page and restore security.txt

ddiff --git a/README.md b/README.md
iindex e34a906..083af10 100644
---- a/README.md
++++ b/README.md
@@@ -11,4 +11,6 @@ To run the schema migrations before the service serves, start it once with the d
  ## Deploy files
  
  - `deploy/systemd/openvibe-bot.service` — systemd unit (`EnvironmentFile=/etc/openvibe/bot.env`, `PORT=4630`, hardening and `Restart=always`).
--- `deploy/nginx/openvibe.bot.conf` — nginx reference site for openvibe.bot: TLS, www→apex, rate limits, and WebSocket upgrade headers for the device (`/device`) and operator (`/control`) sockets, passing the `Authorization` header through.
++- `deploy/nginx/openvibe.bot.conf` — nginx reference site for openvibe.bot: TLS, www→apex, rate limits, and WebSocket upgrade headers for the device (`/device`) and operator (`/control`) sockets, passing the `Authorization` header through. It serves the existing Sites page from `/opt/openvibe.sites/dist/openvibe.bot` and shared assets from `/opt/openvibe.sites/dist/_shared`.
++
++Before installing this vhost, the OpenVibe.Sites owner must stop its catalog and deploy pipeline from generating or replacing `/etc/nginx/sites-available/openvibe.bot.conf`, while continuing to publish the page and shared assets at the paths above. Coordinate the single vhost handoff with that owner; then install this config, validate nginx, and reload it after `openvibe-bot.service` is ready. A later Sites deploy must not overwrite Bot's `/device` and `/control` routes.
ddiff --git a/deploy/nginx/openvibe.bot.conf b/deploy/nginx/openvibe.bot.conf
iindex b214694..fa00ce4 100644
---- a/deploy/nginx/openvibe.bot.conf
++++ b/deploy/nginx/openvibe.bot.conf
@@@ -5,7 +5,7 @@
  ## after changing it. The Node app (port 4630, systemd unit openvibe-bot) serves the REST API and
  ## terminates the device (`/device`) and operator (`/control`) WebSockets; nginx terminates TLS,
  ## redirects www → apex, upgrades the two WebSocket routes, rate-limits sign-in and the API, and
--## compresses text.
++## serves the existing OpenVibe.Sites public page and shared assets.
  ##
  ## No proxy_cache: the app decides cacheability per response (no-store on the API), and device and
  ## operator sockets must never be buffered or cached. Never log request bodies or the Authorization
@@@ -49,9 +49,13 @@ server {
      listen [::]:443 ssl;
      http2 on;
      server_name openvibe.bot;
++    include snippets/security-txt.conf;
  
      ssl_certificate     /etc/letsencrypt/live/openvibe.bot/fullchain.pem;
      ssl_certificate_key /etc/letsencrypt/live/openvibe.bot/privkey.pem;
++
++    root /opt/openvibe.sites/dist/openvibe.bot;
++    index index.html;
      ssl_protocols       TLSv1.2 TLSv1.3;
  
      access_log /var/log/nginx/openvibe.bot.access.log;
@@@ -124,9 +128,14 @@ server {
      # ── Prometheus metrics: host-local scrapers only (http://127.0.0.1:4630/metrics) ──
      location = /metrics { return 404; }
  
--    # ── Everything else (the panel, release.json, static assets) ──
++    # ── Existing public page and shared browser assets ────────────
++    # Sites continues to build these files after Bot takes ownership of the vhost.
++    location ^~ /shared/ {
++        alias /opt/openvibe.sites/dist/_shared/;
++    }
++
      location / {
--        proxy_pass http://127.0.0.1:4630;
++        try_files $uri $uri/ =404;
      }
  
      location ~ /\.(?!well-known) {