Release 0.3.0: private-beta gate + anonymous read mode

Adds an email allowlist (toggleable per deployment) that restricts
OAuth sign-in to listed emails while keeping read paths public.
Anonymous visitors now see the full app shell in read-only mode
instead of the §14.1 landing wall. Empty allowlist = gate off, so
deployments that don't enable it behave exactly as 0.2.3.

Also fixes single-finger scroll on /philosophy and other .chrome-pane
views on iOS Safari (.app: 100vh → 100dvh).

Renames deploy/nginx/rfc.wiggleverse.org.conf →
ohm.wiggleverse.org.conf to match the deployed-domain rename
(rfc.wiggleverse.org deprovisioned 2026-05-27).

See CHANGELOG.md for full details + upgrade steps.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

frontend/.env.example

@@ -13,3 +13,14 @@
 #   VITE_APP_NAME=Wiggleverse RFC
 #   VITE_APP_NAME=Wiggleverse Open Human Model
 VITE_APP_NAME=
+
+# Optional contact line shown on the /beta-pending page when a deployment
+# is in private-beta mode (i.e. the backend's `allowed_emails` table has
+# rows). Free-text — an email address, a URL, or a one-line instruction
+# tells visitors how to request an invitation. If unset, the page falls
+# back to a generic "contact the deployment operator" line.
+#
+# Examples:
+#   VITE_BETA_CONTACT=ben@wiggleverse.org
+#   VITE_BETA_CONTACT=DM @ben on Matrix
+VITE_BETA_CONTACT=