nginx tenants: GET /auth/me on the API zone (the navbar's session read on every page load was held to the sign-in flow's 10/min) (#125)

ddiff --git a/templates/nginx/tenants.conf.tmpl b/templates/nginx/tenants.conf.tmpl
iindex cf30e07..d803a26 100644
---- a/templates/nginx/tenants.conf.tmpl
++++ b/templates/nginx/tenants.conf.tmpl
@@@ -49,6 +49,13 @@ server {
      proxy_set_header CF-Connecting-IP $remote_addr;
      proxy_set_header X-Forwarded-Proto $scheme;
  
++    # GET /auth/me runs on every page load (the navbar's session): the API zone, not the sign-in flow's 10/min,
++    # or a visitor who opens a dozen pages in a minute shows as signed out (the browser check's 429s, 2026-10-17).
++    location = /auth/me {
++        limit_req zone={{zone}}_api burst=30 nodelay;
++        proxy_pass http://127.0.0.1:{{port}};
++    }
++
      location /auth/ {
          limit_req zone={{zone}}_auth burst=10 nodelay;
          proxy_pass http://127.0.0.1:{{port}};
ddiff --git a/test/nginx-tenants.test.js b/test/nginx-tenants.test.js
iindex 66e5449..3aa7a57 100644
---- a/test/nginx-tenants.test.js
++++ b/test/nginx-tenants.test.js
@@@ -43,6 +43,8 @@ runTests([
          assert.match(r.out, /proxy_hide_header Set-Cookie;/);
          assert.match(r.out, /location ~ \^\/\(api\/v1\/\)\?sites\/\[A-Za-z0-9_\]\+\/deploys\$ \{[\s\S]*client_max_body_size 110m;/);
          assert.match(r.out, /location = \/metrics \{ return 404; \}/);
++        assert.match(r.out, /location = \/auth\/me \{\n +limit_req zone=ovhost_api burst=30 nodelay;/, 'the session read on every page load is not held to the sign-in limit');
++        assert.match(r.out, /location \/auth\/ \{\n +limit_req zone=ovhost_auth burst=10 nodelay;/);
          assert.match(r.out, /server_name www\.tenant-a\.org;\n\n    ssl_certificate +\/etc\/letsencrypt\/live\/www\.tenant-a\.org\/fullchain\.pem;/, 'HTTPS where a certificate exists');
          assert.ok(!/server_name docs\.tenant-b\.net;\n\n    ssl_certificate/.test(r.out), 'no HTTPS block without a certificate');
          assert.match(r.out, /server_name docs\.tenant-b\.net;[\s\S]*?location \/ \{ return 404; \}/, 'ACME only until the certificate exists');