Allow rating API preflights through Report nginx (#178)

ddiff --git a/deploy/nginx/openvibe.report.conf b/deploy/nginx/openvibe.report.conf
iindex 3ddd2dd..55db326 100644
---- a/deploy/nginx/openvibe.report.conf
++++ b/deploy/nginx/openvibe.report.conf
@@@ -6,7 +6,7 @@
  ## the API; nginx terminates TLS, redirects www → apex, rate-limits the API, and compresses text.
  ##
  ## No proxy_cache: the app decides cacheability per response (public for two minutes on pages and API, an hour on
--## the crawl artifacts, immutable only for a content-addressed asset). The API is GET-only.
++## the crawl artifacts, immutable only for a content-addressed asset). The API permits reads and CORS preflights.
  ## ═══════════════════════════════════════════════════════════════
  
  limit_req_zone $binary_remote_addr zone=report_api:10m rate=5r/s;
@@@ -66,10 +66,10 @@ server {
      proxy_set_header CF-Connecting-IP $remote_addr;
      proxy_set_header X-Forwarded-Proto $scheme;
  
--    # ── API: GET and HEAD only, with the app's 120/min limit backed by a coarse nginx one ──
++    # ── Public API reads and CORS negotiation, backed by the app's method checks ──
      location /api/ {
--        add_header Allow "GET, HEAD" always;
--        if ($request_method !~ ^(GET|HEAD)$) { return 405; }
++        add_header Allow "GET, HEAD, OPTIONS" always;
++        if ($request_method !~ ^(GET|HEAD|OPTIONS)$) { return 405; }
          limit_req zone=report_api burst=20 nodelay;
          limit_req_status 429;
          proxy_pass http://127.0.0.1:5080;