Release 0.3.0: private-beta gate + anonymous read mode

Adds an email allowlist (toggleable per deployment) that restricts
OAuth sign-in to listed emails while keeping read paths public.
Anonymous visitors now see the full app shell in read-only mode
instead of the §14.1 landing wall. Empty allowlist = gate off, so
deployments that don't enable it behave exactly as 0.2.3.

Also fixes single-finger scroll on /philosophy and other .chrome-pane
views on iOS Safari (.app: 100vh → 100dvh).

Renames deploy/nginx/rfc.wiggleverse.org.conf →
ohm.wiggleverse.org.conf to match the deployed-domain rename
(rfc.wiggleverse.org deprovisioned 2026-05-27).

See CHANGELOG.md for full details + upgrade steps.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

deploy/RUNBOOK.md

@@ -1,6 +1,6 @@
 # Runbook
 
-Single-host deployment of the RFC app at `rfc.wiggleverse.org`, sharing
+Single-host deployment of the RFC app at `ohm.wiggleverse.org`, sharing
 infrastructure with `git.wiggleverse.org` (same Gitea instance, same nginx,
 same Let's Encrypt). The shape matches §4.2: one process, one SQLite file,
 no separate worker.
@@ -18,7 +18,7 @@ recover from a partial install is safe.
 
 - Ubuntu/Debian-style host with nginx and certbot already serving
   `git.wiggleverse.org` over HTTPS.
-- DNS: an `A` record for `rfc.wiggleverse.org` pointing at the same IP as
+- DNS: an `A` record for `ohm.wiggleverse.org` pointing at the same IP as
   `git.wiggleverse.org`.
 - Python 3.11+ available system-wide (the project has no `requires-python`
   pin; the current production VM runs 3.11 on Debian bookworm). Node 20+
@@ -75,7 +75,7 @@ Invite → rfc-bot → Owner**.
 Integrations → OAuth2 Applications → Create Application**:
 
 - Name: `RFC App`
-- Redirect URI: `https://rfc.wiggleverse.org/auth/callback`
+- Redirect URI: `https://ohm.wiggleverse.org/auth/callback`
 
 Copy the client ID and client secret. They go into `.env`.
 
@@ -93,7 +93,7 @@ sudo -u rfc-app /opt/rfc-app/backend/.venv/bin/pip install \
 
 ```sh
 # On your laptop:
-cd frontend && npm install && npm run build
+cd frontend && npm ci && npm run build
 rsync -a dist/ ben.stull@<host>:/tmp/rfc-app-dist/
 # On the host:
 sudo -u rfc-app mkdir -p /opt/rfc-app/frontend/dist
@@ -104,10 +104,16 @@ sudo chown -R rfc-app:rfc-app /opt/rfc-app/frontend/dist
 Or build on the host directly if Node is installed there:
 
 ```sh
-cd /opt/rfc-app/frontend && sudo -u rfc-app npm install
+cd /opt/rfc-app/frontend && sudo -u rfc-app npm ci
 sudo -u rfc-app npm run build
 ```
 
+`npm ci` installs strictly from the committed `package-lock.json` and
+refuses to mutate it. `npm install` was previously used here but can
+regenerate the lockfile in place (e.g. stripping `libc` fields from
+optional rollup native packages), which then collides with `git
+checkout <tag>` on the next deploy.
+
 **1.3.3 Write `.env`.**
 
 ```sh
@@ -128,7 +134,7 @@ META_REPO=meta
 OAUTH_CLIENT_ID=<from 1.2.3>
 OAUTH_CLIENT_SECRET=<from 1.2.3>
 
-APP_URL=https://rfc.wiggleverse.org
+APP_URL=https://ohm.wiggleverse.org
 SECRET_KEY=<openssl rand -hex 32>
 OWNER_GITEA_LOGIN=ben.stull
 GITEA_WEBHOOK_SECRET=<openssl rand -hex 32>
@@ -182,9 +188,9 @@ Re-running is safe; every step is upsert-shaped.
 **1.4.1 nginx vhost.**
 
 ```sh
-sudo cp /opt/rfc-app/deploy/nginx/rfc.wiggleverse.org.conf \
-    /etc/nginx/sites-available/rfc.wiggleverse.org
-sudo ln -s /etc/nginx/sites-available/rfc.wiggleverse.org \
+sudo cp /opt/rfc-app/deploy/nginx/ohm.wiggleverse.org.conf \
+    /etc/nginx/sites-available/ohm.wiggleverse.org
+sudo ln -s /etc/nginx/sites-available/ohm.wiggleverse.org \
     /etc/nginx/sites-enabled/
 sudo nginx -t && sudo systemctl reload nginx
 ```
@@ -200,7 +206,7 @@ sudo systemctl reload nginx
 **1.4.2 Let's Encrypt cert.**
 
 ```sh
-sudo certbot --nginx -d rfc.wiggleverse.org
+sudo certbot --nginx -d ohm.wiggleverse.org
 ```
 
 ### 1.5 systemd
@@ -226,7 +232,7 @@ RFC app started — meta repo wiggleverse/meta
 
 ### 1.6 Smoke test
 
-In a browser at `https://rfc.wiggleverse.org`:
+In a browser at `https://ohm.wiggleverse.org`:
 
 1. The landing page renders (§14.1 — title, pitch, three-item deck,
    sign-in affordance).
@@ -384,7 +390,7 @@ say), restore from the most recent backup per §2.2.
   `rfc-app`.
 - **OAuth callback returns "Invalid state".** The redirect URI in Gitea
   must match `APP_URL/auth/callback` exactly. Confirm it's
-  `https://rfc.wiggleverse.org/auth/callback`.
+  `https://ohm.wiggleverse.org/auth/callback`.
 - **The catalog stays empty after a merge.** Check the webhook:
   `journalctl -u rfc-app | grep webhook`. Gitea's **Settings → Webhooks
   → Recent Deliveries** on the meta repo shows the delivery status; the