nginx: /auth/me, the session probe the shared navbar asks on every page view, gets its own location on the API zone (burst 30) instead of the sign-in zone (10 a minute, burst 10), and both answer 429 when limited instead of nginx's default 503. The browser check (Host scripts/browser-check.js, WS-Q task 3) saw /auth/me answer 503 after about ten quick page loads, which the navbar takes as signed out. test/nginx-auth-limit.test.js. Takes effect when the vhost is next installed (not deployed here)

ddiff --git a/deploy/nginx/openvibe.community.conf b/deploy/nginx/openvibe.community.conf
iindex 025f208..fe6231f 100644
---- a/deploy/nginx/openvibe.community.conf
++++ b/deploy/nginx/openvibe.community.conf
@@@ -68,8 +68,24 @@ server {
      gzip_types text/css application/javascript text/javascript application/json image/svg+xml text/plain application/xml text/xml application/rss+xml;
  
      # ── OAuth session endpoints (strict rate limit) ─────────
++    # The session probe: the shared navbar asks it on every page view, so it cannot share the sign-in
++    # budget below (10 a minute): a visitor reading quickly was answered 503 and looked signed out
++    # (found by the browser check, OpenVibe.Host scripts/browser-check.js).
++    location = /auth/me {
++        limit_req zone=ovcommunity_api burst=30 nodelay;
++        limit_req_status 429;
++        proxy_pass http://127.0.0.1:4200;
++        proxy_http_version 1.1;
++        proxy_set_header Host $host;
++        proxy_set_header X-Real-IP $remote_addr;
++        proxy_set_header X-Forwarded-For $remote_addr;
++        proxy_set_header CF-Connecting-IP $remote_addr;
++        proxy_set_header X-Forwarded-Proto $scheme;
++    }
++
      location /auth/ {
          limit_req zone=ovcommunity_auth burst=10 nodelay;
++        limit_req_status 429;
          proxy_pass http://127.0.0.1:4200;
          proxy_http_version 1.1;
          proxy_set_header Host $host;
ddiff --git a/test/nginx-auth-limit.test.js b/test/nginx-auth-limit.test.js
nnew file mode 100644
iindex 0000000..83b7305
---- /dev/null
++++ b/test/nginx-auth-limit.test.js
@@@ -0,0 +1,20 @@
++'use strict';
++// deploy/nginx/openvibe.community.conf: the shared navbar asks /auth/me on every page view, so the session probe has its own location on
++// the API zone; the sign-in routes keep the strict zone (10 a minute). Both answer 429 when limited, not
++// nginx's default 503 (the browser check, OpenVibe.Host scripts/browser-check.js, found /auth/me answering
++// 503 after about ten quick page loads, which the navbar reads as signed out).
++const assert = require('assert');
++const fs = require('fs');
++const path = require('path');
++
++const conf = fs.readFileSync(path.join(__dirname, '..', ...'deploy/nginx/openvibe.community.conf'.split('/')), 'utf8');
++const block = (loc) => { const m = conf.match(new RegExp(`\\n    location ${loc} \\{\\n([\\s\\S]*?)\\n    \\}`)); return m && m[1]; };
++const probe = block('= /auth/me'), auth = block('/auth/');
++assert.ok(probe && auth, 'both locations');
++assert.ok(conf.indexOf('location = /auth/me') < conf.indexOf('location /auth/ {'));
++assert.match(probe, /limit_req zone=ovcommunity_api burst=30 nodelay;/);
++assert.match(auth, /limit_req zone=ovcommunity_auth burst=10 nodelay;/);
++for (const b of [probe, auth]) assert.match(b, /limit_req_status 429;/);
++const upstream = (b) => (b.match(/proxy_pass (\S+);/) || [])[1];
++assert.ok(upstream(probe) && upstream(probe) === upstream(auth), 'the same upstream');
++console.log('nginx auth limit: /auth/me on the API zone, 429 when limited');