nginx: /metrics is never proxied (404); deploy docs for metrics and readiness

ddiff --git a/deploy/nginx/openvibe.live.conf b/deploy/nginx/openvibe.live.conf
iindex ead76d16..f33c34d9 100644
---- a/deploy/nginx/openvibe.live.conf
++++ b/deploy/nginx/openvibe.live.conf
@@@ -72,6 +72,9 @@ server {
      # ceiling ordinary traffic cannot reach.
      limit_conn addr_limit 256;
  
++    # Prometheus metrics are for local scrapers only; Node also 404s any proxied request to it.
++    location = /metrics { return 404; }
++
      location = /api/auth/register {
          limit_req zone=login_limit burst=5 nodelay;
          proxy_pass http://127.0.0.1:3000;
ddiff --git a/docs/deploy.md b/docs/deploy.md
iindex 5af9ee8c..65ad04d2 100644
---- a/docs/deploy.md
++++ b/docs/deploy.md
@@@ -47,6 +47,12 @@ restart. A rollback resets the checkout but cannot restore previous `node_module
    `OV_APP_ROOT=/opt/openvibe.live/current`, so static files and docs are read through the symlink and
    a static-only switch needs no restart.
  - If the restarted release never becomes ready, `current` is switched back and restarted (exit 3).
++  "Ready" is `GET /api/ready` → 200: boot finished and the database answers. The WebRTC SFU,
++  OpenVibe.Media and the Network signing key are optional checks: when one is missing the answer is
++  still 200 with `"status": "degraded"` and the check named in `degraded`, never a silent pass.
++- `GET /metrics` (Prometheus text: requests by route template, latency, in-flight, process,
++  `release_info`, live streams, WebSocket connections per server, outbox) answers only
++  `curl http://127.0.0.1:3000/metrics` on the host; through nginx it is a 404.
  - `--rollback` selects the previous release with **its own** `node_modules`.
  - The last 5 releases are kept.
  - Content-hashed assets from the previous release are still served under their old hashes, so a page