Release 0.3.0: private-beta gate + anonymous read mode

Adds an email allowlist (toggleable per deployment) that restricts
OAuth sign-in to listed emails while keeping read paths public.
Anonymous visitors now see the full app shell in read-only mode
instead of the §14.1 landing wall. Empty allowlist = gate off, so
deployments that don't enable it behave exactly as 0.2.3.

Also fixes single-finger scroll on /philosophy and other .chrome-pane
views on iOS Safari (.app: 100vh → 100dvh).

Renames deploy/nginx/rfc.wiggleverse.org.conf →
ohm.wiggleverse.org.conf to match the deployed-domain rename
(rfc.wiggleverse.org deprovisioned 2026-05-27).

See CHANGELOG.md for full details + upgrade steps.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

frontend/src/api.js

@@ -534,6 +534,24 @@ export async function listGraduationQueue() {
   return jsonOrThrow(await fetch('/api/admin/graduation-queue'))
 }
 
+export async function listAllowlist() {
+  return jsonOrThrow(await fetch('/api/admin/allowlist'))
+}
+
+export async function addAllowlistEmail(email, note) {
+  return jsonOrThrow(await fetch('/api/admin/allowlist', {
+    method: 'POST',
+    headers: { 'Content-Type': 'application/json' },
+    body: JSON.stringify({ email, note: note || null }),
+  }))
+}
+
+export async function removeAllowlistEmail(email) {
+  return jsonOrThrow(await fetch(`/api/admin/allowlist/${encodeURIComponent(email)}`, {
+    method: 'DELETE',
+  }))
+}
+
 export async function searchUsers(q) {
   const params = new URLSearchParams()
   if (q) params.set('q', q)