Release 0.3.0: private-beta gate + anonymous read mode

Adds an email allowlist (toggleable per deployment) that restricts
OAuth sign-in to listed emails while keeping read paths public.
Anonymous visitors now see the full app shell in read-only mode
instead of the §14.1 landing wall. Empty allowlist = gate off, so
deployments that don't enable it behave exactly as 0.2.3.

Also fixes single-finger scroll on /philosophy and other .chrome-pane
views on iOS Safari (.app: 100vh → 100dvh).

Renames deploy/nginx/rfc.wiggleverse.org.conf →
ohm.wiggleverse.org.conf to match the deployed-domain rename
(rfc.wiggleverse.org deprovisioned 2026-05-27).

See CHANGELOG.md for full details + upgrade steps.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

deploy/nginx/ohm.wiggleverse.org.conf

@@ -2,21 +2,21 @@
 # frontend served as static files from the Vite build output.
 #
 # Install:
-#   sudo cp deploy/nginx/rfc.wiggleverse.org.conf \
-#       /etc/nginx/sites-available/rfc.wiggleverse.org
-#   sudo ln -s /etc/nginx/sites-available/rfc.wiggleverse.org \
+#   sudo cp deploy/nginx/ohm.wiggleverse.org.conf \
+#       /etc/nginx/sites-available/ohm.wiggleverse.org
+#   sudo ln -s /etc/nginx/sites-available/ohm.wiggleverse.org \
 #       /etc/nginx/sites-enabled/
 #   sudo nginx -t && sudo systemctl reload nginx
 #
 # Then add the Let's Encrypt cert:
-#   sudo certbot --nginx -d rfc.wiggleverse.org
+#   sudo certbot --nginx -d ohm.wiggleverse.org
 # Certbot will rewrite this file to add the 443 listener and certificate
 # directives; the rest of the config below stays as written.
 
 server {
     listen 80;
     listen [::]:80;
-    server_name rfc.wiggleverse.org;
+    server_name ohm.wiggleverse.org;
 
     # Static SPA assets live in the Vite build output. The systemd unit
     # runs as user `rfc-app`; make sure nginx (usually `www-data`) can