Open Tours messages in Dock Chats (#115)

ddiff --git a/deploy/nginx/openvibe.tours.conf b/deploy/nginx/openvibe.tours.conf
iindex 39d17ce..9a1755b 100644
---- a/deploy/nginx/openvibe.tours.conf
++++ b/deploy/nginx/openvibe.tours.conf
@@@ -79,6 +79,13 @@ server {
          proxy_pass http://127.0.0.1:5170;
      }
  
++    # Give the Dock token the session probe's rate-limit budget.
++    location = /auth/navbar-token {
++        limit_req zone=tours_api burst=30 nodelay;
++        limit_req_status 429;
++        proxy_pass http://127.0.0.1:5170;
++    }
++
      location /auth/ {
          limit_req zone=tours_auth burst=10 nodelay;
          limit_req_status 429;
ddiff --git a/server/app.js b/server/app.js
iindex 04bacfb..62b4be7 100644
---- a/server/app.js
++++ b/server/app.js
@@@ -123,7 +123,7 @@ async function createApp(opts = {}) {
      app.use(sso.middleware());
  
      // ── Sign-in (OAuth2 + PKCE client of OpenVibe.Network) ──
--    app.use('/auth/', rateLimit({ windowMs: 15 * 60_000, limit: 60, standardHeaders: true, legacyHeaders: false }));
++    app.use('/auth/', rateLimit({ windowMs: 15 * 60_000, limit: 60, skip: (req) => req.path === '/me' || req.path === '/navbar-token', standardHeaders: true, legacyHeaders: false }));
      app.use('/auth', sso.routes());
      { const legal = require('openvibe-shared/legal'); app.get(legal.PATHS, legal.handler({ id: 'tours', service: 'tours', host: 'openvibe.tours', name: 'OpenVibe.Tours', profile: 'ugc' })); }
  
ddiff --git a/server/auth/sso.js b/server/auth/sso.js
iindex b94ffc0..d014d5d 100644
---- a/server/auth/sso.js
++++ b/server/auth/sso.js
@@@ -268,6 +268,14 @@ function createSso({ config, keys, fetchImpl = globalThis.fetch, now = () => Dat
              if (!v || v.kind !== 'user') return res.status(401).json({ error: 'Not signed in' });
              res.json({ user: { username: v.username, display_name: v.displayName, subject_id: v.subject, role: v.role, avatar_url: v.avatarUrl || null, profile_color: v.profileColor || null } });
          });
++
++        // The shared Dock needs a verified Network access token from this HTTP-only session.
++        r.get('/navbar-token', (req, res) => {
++            res.set('Cache-Control', cache.htmlHeaders({ private: true }));
++            const viewer = req.viewer;
++            if (!viewer || viewer.kind !== 'user' || !viewer.token) return res.status(401).json({ error: 'Not signed in' });
++            return res.json({ token: viewer.token });
++        });
          return r;
      }
  
ddiff --git a/server/render/layout.js b/server/render/layout.js
iindex 4fc48b7..0c5ccf1 100644
---- a/server/render/layout.js
++++ b/server/render/layout.js
@@@ -59,6 +59,7 @@ function renderPage(o) {
          history: { type: 'page', title: o.title || SITE_NAME },
          silentLogin: `${o.config.baseUrl}/auth/login?silent=1&next={url}`,
          sessionUrl: '/auth/me',
++        tokenUrl: '/auth/navbar-token',
          loginUrl: '/auth/login?next={path}',
          logoutUrl: '/auth/logout?next={path}',
          notificationsRealtime: true,
ddiff --git a/test/sso.test.js b/test/sso.test.js
iindex 9fc6496..93e24f5 100644
---- a/test/sso.test.js
++++ b/test/sso.test.js
@@@ -47,6 +47,11 @@ const { sanitizeNext } = require('../server/auth/sso');
          const me = await t.get('/auth/me', { cookie: `tours_at=${at}` });
          assert.strictEqual(me.json().user.username, 'kim');
          assert.ok(!me.text.includes(at), '/auth/me never returns the token');
++        const nav = await t.get('/auth/navbar-token', { cookie: `tours_at=${at}` });
++        assert.strictEqual(nav.status, 200);
++        assert.strictEqual(nav.json().token, at, 'the Dock receives the verified Network token');
++        assert.strictEqual(nav.headers.get('cache-control'), 'private, no-store');
++        assert.strictEqual((await t.get('/auth/navbar-token')).status, 401, 'a guest receives no token');
      });
  
      await check('a wrong state, a verifier that does not match, or no flow cookie is refused', async () => {