Release 0.3.0: private-beta gate + anonymous read mode

Adds an email allowlist (toggleable per deployment) that restricts
OAuth sign-in to listed emails while keeping read paths public.
Anonymous visitors now see the full app shell in read-only mode
instead of the §14.1 landing wall. Empty allowlist = gate off, so
deployments that don't enable it behave exactly as 0.2.3.

Also fixes single-finger scroll on /philosophy and other .chrome-pane
views on iOS Safari (.app: 100vh → 100dvh).

Renames deploy/nginx/rfc.wiggleverse.org.conf →
ohm.wiggleverse.org.conf to match the deployed-domain rename
(rfc.wiggleverse.org deprovisioned 2026-05-27).

See CHANGELOG.md for full details + upgrade steps.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

backend/app/main.py

@@ -107,6 +107,12 @@ def _oauth_router(config) -> APIRouter:
         if not access_token:
             raise HTTPException(400, "Token exchange failed")
         profile = await auth.fetch_user_profile(config, access_token)
+        if not auth.is_allowed_sign_in(profile):
+            # Private-beta gate: clear any partial OAuth state and bounce to
+            # the public /beta-pending page. The session is left empty so the
+            # rejected viewer continues as anonymous read-only.
+            request.session.pop(auth.SESSION_STATE_KEY, None)
+            return RedirectResponse("/beta-pending")
         user = auth.provision_user(config, profile)
         auth.store_session(request, user)
         return RedirectResponse("/")