Watch's vhost: openvibe.watch's own certificate (the openvibe.network one made Cloudflare answer 526), the www redirect and security.txt (#8)

ddiff --git a/deploy/nginx/openvibe.watch.conf b/deploy/nginx/openvibe.watch.conf
iindex e682599..b9ef2c7 100644
---- a/deploy/nginx/openvibe.watch.conf
++++ b/deploy/nginx/openvibe.watch.conf
@@@ -37,12 +37,23 @@ limit_req_zone $watch_form_key zone=watch_forms:10m rate=1r/s;
  server {
      listen 80;
      listen [::]:80;
--    server_name openvibe.watch;
++    server_name openvibe.watch www.openvibe.watch;
  
      location /.well-known/acme-challenge/ { root /var/www/certbot; }
      location / { return 301 https://openvibe.watch$request_uri; }
  }
  
++# ── www → apex ─────────────────────────────────────────────
++server {
++    listen 443 ssl;
++    listen [::]:443 ssl;
++    http2 on;
++    server_name www.openvibe.watch;
++    ssl_certificate     /etc/letsencrypt/live/openvibe.watch/fullchain.pem;
++    ssl_certificate_key /etc/letsencrypt/live/openvibe.watch/privkey.pem;
++    return 301 https://openvibe.watch$request_uri;
++}
++
  # ── HTTPS server ───────────────────────────────────────────
  server {
      listen 443 ssl;
@@@ -50,9 +61,10 @@ server {
      http2 on;
      server_name openvibe.watch;
  
--    # The host has the openvibe.network wildcard certificate, not a per-name one.
--    ssl_certificate     /etc/letsencrypt/live/openvibe.network/fullchain.pem;
--    ssl_certificate_key /etc/letsencrypt/live/openvibe.network/privkey.pem;
++    # openvibe.watch has its own certificate (the openvibe.network one does not cover this name: Cloudflare answers 526).
++    include snippets/security-txt.conf;   # /.well-known/security.txt (host file; SECURITY.md in every repo)
++    ssl_certificate     /etc/letsencrypt/live/openvibe.watch/fullchain.pem;
++    ssl_certificate_key /etc/letsencrypt/live/openvibe.watch/privkey.pem;
      ssl_protocols       TLSv1.2 TLSv1.3;
  
      access_log /var/log/nginx/openvibe.watch.access.log;