nginx (openvibe.network): /oauth/token gets its own limit (60/min, burst 30) instead of the sign-in limit (5/min) — a developer app's client-credentials tokens got 503s mid-flow (found by the daily developer path); limits answer 429; the security.txt include as production has it

ddiff --git a/deploy/nginx/openvibe.network.conf b/deploy/nginx/openvibe.network.conf
iindex b9a7bccc..ef0eaa5e 100644
---- a/deploy/nginx/openvibe.network.conf
++++ b/deploy/nginx/openvibe.network.conf
@@@ -12,6 +12,9 @@
  
  limit_req_zone $binary_remote_addr zone=openvibenetwork_api:10m rate=10r/s;
  limit_req_zone $binary_remote_addr zone=openvibenetwork_auth:10m rate=5r/m;
++# Token issuance for apps (client credentials, code exchange, refresh): not a password check, so not the
++# sign-in limit — a developer's app needs a few tokens a minute (one per audience) and got 503s at 5/min.
++limit_req_zone $binary_remote_addr zone=openvibenetwork_token:10m rate=60r/m;
  
  # ── HTTP → HTTPS redirect ──────────────────────────────────
  server {
@@@ -40,6 +43,7 @@ server {
      listen [::]:443 ssl;
      http2 on;
      server_name openvibe.network;
++    include snippets/security-txt.conf;   # /.well-known/security.txt (the host's file)
  
      ssl_certificate     /etc/letsencrypt/live/openvibe.network/fullchain.pem;
      ssl_certificate_key /etc/letsencrypt/live/openvibe.network/privkey.pem;
@@@ -56,9 +60,23 @@ server {
      # Prometheus metrics are for loopback scrapers only (the app also 404s any proxied request).
      location = /metrics { return 404; }
  
++    # ── Token endpoint (its own limit; 429 when exceeded, as the app answers) ──
++    location = /oauth/token {
++        limit_req zone=openvibenetwork_token burst=30 nodelay;
++        limit_req_status 429;
++        proxy_pass http://127.0.0.1:4000;
++        proxy_http_version 1.1;
++        proxy_set_header Host $host;
++        proxy_set_header X-Real-IP $remote_addr;
++        proxy_set_header X-Forwarded-For $remote_addr;
++        proxy_set_header CF-Connecting-IP $remote_addr;
++        proxy_set_header X-Forwarded-Proto $scheme;
++    }
++
      # ── Auth endpoints (strict rate limit) ──────────────────
--    location ~ ^/(api/auth/(register|login|anon-session)|oauth/(token|authorize)) {
++    location ~ ^/(api/auth/(register|login|anon-session)|oauth/authorize) {
          limit_req zone=openvibenetwork_auth burst=5 nodelay;
++        limit_req_status 429;
          proxy_pass http://127.0.0.1:4000;
          proxy_http_version 1.1;
          proxy_set_header Host $host;