deploy/nginx/openvibe.chat.conf: the reference vhost for openvibe.chat (everything to Chat on 4400, /ws/chat upgraded with long timeouts, sign-in/API/form posts rate-limited, /internal and /metrics 404, client address from the connection only)

ddiff --git a/deploy/nginx/openvibe.chat.conf b/deploy/nginx/openvibe.chat.conf
nnew file mode 100644
iindex 0000000..b8006c1
---- /dev/null
++++ b/deploy/nginx/openvibe.chat.conf
@@@ -0,0 +1,105 @@
++## ═══════════════════════════════════════════════════════════════
++## openvibe.chat — Nginx Configuration (REFERENCE)
++##
++## Deployed to /etc/nginx/sites-available/openvibe.chat.conf — keep them in sync and reload nginx
++## after changing it. Live since 2026-09-24 (the launch release removed openvibe.chat from
++## OpenVibe.Sites/sites.json).
++##
++## OpenVibe.Chat (port 4400, systemd unit openvibe-chat) renders every page (server/web/) and serves
++## the chat API and /ws/chat itself, so openvibe.chat works while OpenVibe.Live is down. nginx
++## terminates TLS, redirects www → apex, rate-limits sign-in, the API and form posts, sets the
++## client address from the connection only, and caches nothing: Chat's Cache-Control decides.
++## ═══════════════════════════════════════════════════════════════
++
++limit_req_zone $binary_remote_addr zone=ovchat_api:10m rate=10r/s;
++limit_req_zone $binary_remote_addr zone=ovchat_auth:10m rate=10r/m;
++map $request_method $ovchat_write_key { default ""; POST $binary_remote_addr; }
++limit_req_zone $ovchat_write_key zone=ovchat_write:10m rate=30r/m;
++
++server {
++    listen 80;
++    listen [::]:80;
++    server_name openvibe.chat www.openvibe.chat;
++    location /.well-known/acme-challenge/ { root /var/www/certbot; }
++    location / { return 301 https://openvibe.chat$request_uri; }
++}
++
++server {
++    listen 443 ssl;
++    listen [::]:443 ssl;
++    http2 on;
++    server_name www.openvibe.chat;
++    ssl_certificate     /etc/letsencrypt/live/openvibe.chat/fullchain.pem;
++    ssl_certificate_key /etc/letsencrypt/live/openvibe.chat/privkey.pem;
++    ssl_protocols       TLSv1.2 TLSv1.3;
++    return 301 https://openvibe.chat$request_uri;
++}
++
++server {
++    listen 443 ssl;
++    listen [::]:443 ssl;
++    http2 on;
++    server_name openvibe.chat;
++    include snippets/security-txt.conf;   # /.well-known/security.txt (host file; SECURITY.md in every repo)
++
++    ssl_certificate     /etc/letsencrypt/live/openvibe.chat/fullchain.pem;
++    ssl_certificate_key /etc/letsencrypt/live/openvibe.chat/privkey.pem;
++    ssl_protocols       TLSv1.2 TLSv1.3;
++
++    access_log /var/log/nginx/openvibe.chat.access.log;
++    error_log  /var/log/nginx/openvibe.chat.error.log;
++
++    client_max_body_size 1m;
++
++    add_header X-Content-Type-Options nosniff always;
++    add_header X-Frame-Options SAMEORIGIN always;
++    add_header Referrer-Policy strict-origin-when-cross-origin always;
++    add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always;
++
++    gzip on;
++    gzip_proxied any;
++    gzip_vary on;
++    gzip_comp_level 5;
++    gzip_min_length 1024;
++    gzip_types text/css application/javascript text/javascript application/json image/svg+xml text/plain application/xml text/xml;
++
++    proxy_http_version 1.1;
++    proxy_set_header Host $host;
++    proxy_set_header X-Real-IP $remote_addr;
++    proxy_set_header X-Forwarded-For $remote_addr;
++    proxy_set_header CF-Connecting-IP $remote_addr;
++    proxy_set_header X-Forwarded-Proto $scheme;
++    proxy_no_cache 1;
++    proxy_cache_bypass 1;
++
++    # Host-only surfaces (the app refuses them from the proxy too).
++    location = /metrics { return 404; }
++    location ^~ /internal/ { return 404; }
++
++    location ^~ /ws/chat {
++        proxy_pass http://127.0.0.1:4400;
++        proxy_set_header Upgrade $http_upgrade;
++        proxy_set_header Connection "upgrade";
++        proxy_read_timeout 3600s;
++        proxy_send_timeout 3600s;
++    }
++
++    location /auth/ {
++        limit_req zone=ovchat_auth burst=10 nodelay;
++        proxy_set_header Connection "";
++        proxy_pass http://127.0.0.1:4400;
++    }
++
++    location /api/ {
++        limit_req zone=ovchat_api burst=40 nodelay;
++        client_max_body_size 10m;
++        proxy_set_header Connection "";
++        proxy_pass http://127.0.0.1:4400;
++    }
++
++    location / {
++        limit_req zone=ovchat_write burst=20 nodelay;
++        proxy_set_header Connection "";
++        proxy_pass http://127.0.0.1:4400;
++    }
++}