nginx: the navbar's /auth/me read gets the API's budget (the sign-in zone 429s it), /internal answers 404

ddiff --git a/deploy/nginx/openvibe.design.conf b/deploy/nginx/openvibe.design.conf
iindex 0125f0a..a92172d 100644
---- a/deploy/nginx/openvibe.design.conf
++++ b/deploy/nginx/openvibe.design.conf
@@@ -80,6 +80,13 @@ server {
      # ── Sign-in: GET only ───────────────────────────────────
      # /auth/login, /auth/callback, /auth/me and /auth/logout are all GETs here. The app's POST /auth/logout confirm
      # is defence in depth and is not exposed by nginx; a same-origin navigation signs out directly.
++    # The navbar's session probe runs on every page view: it gets the API's budget, not sign-in's.
++    location = /auth/me {
++        limit_req zone=design_api burst=30 nodelay;
++        limit_req_status 429;
++        proxy_pass http://127.0.0.1:5090;
++    }
++
      location /auth/ {
          limit_except GET { deny all; }
          limit_req zone=design_auth burst=10 nodelay;
@@@ -89,6 +96,7 @@ server {
  
      # ── Prometheus metrics: host-local scrapers only (http://127.0.0.1:5090/metrics) ──
      location ~* ^/metrics(/|$) { return 404; }
++    location ~* ^/internal(/|$) { return 404; }
  
      # ── Pages, discovery, static assets, release.json ──────
      location / {