The backend already serves /sentry-tunnel itself with its own rate limit, payload cap, and DSN-derived destination - exactly what that nginx block exists to avoid needing. Proxying the same path at nginx intercepts it first and silently drops all three protections.