Release 0.3.0: private-beta gate + anonymous read mode

Adds an email allowlist (toggleable per deployment) that restricts
OAuth sign-in to listed emails while keeping read paths public.
Anonymous visitors now see the full app shell in read-only mode
instead of the §14.1 landing wall. Empty allowlist = gate off, so
deployments that don't enable it behave exactly as 0.2.3.

Also fixes single-finger scroll on /philosophy and other .chrome-pane
views on iOS Safari (.app: 100vh → 100dvh).

Renames deploy/nginx/rfc.wiggleverse.org.conf →
ohm.wiggleverse.org.conf to match the deployed-domain rename
(rfc.wiggleverse.org deprovisioned 2026-05-27).

See CHANGELOG.md for full details + upgrade steps.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

frontend/src/components/Admin.jsx

@@ -19,10 +19,14 @@ import {
   listAuditLog,
   listPermissionEvents,
   listGraduationQueue,
+  listAllowlist,
+  addAllowlistEmail,
+  removeAllowlistEmail,
 } from '../api.js'
 
 const TABS = [
   { path: 'users', label: 'Users' },
+  { path: 'allowlist', label: 'Allowlist' },
   { path: 'graduation', label: 'Graduation queue' },
   { path: 'audit', label: 'Audit log' },
   { path: 'permissions', label: 'Permission events' },
@@ -54,6 +58,7 @@ export default function Admin({ viewer }) {
         <Routes>
           <Route index element={<UsersTab />} />
           <Route path="users" element={<UsersTab />} />
+          <Route path="allowlist" element={<AllowlistTab />} />
           <Route path="graduation" element={<GraduationTab />} />
           <Route path="audit" element={<AuditTab />} />
           <Route path="permissions" element={<PermissionsTab />} />
@@ -174,6 +179,140 @@ function UsersTab() {
   )
 }
 
+// ── Private-beta allowlist (`migrations/011_allowlist.sql`) ────────────────
+
+function AllowlistTab() {
+  const [data, setData] = useState(null)
+  const [error, setError] = useState(null)
+  const [draftEmail, setDraftEmail] = useState('')
+  const [draftNote, setDraftNote] = useState('')
+  const [busy, setBusy] = useState(false)
+
+  async function refresh() {
+    setError(null)
+    try {
+      setData(await listAllowlist())
+    } catch (e) {
+      setError(e.message)
+    }
+  }
+
+  useEffect(() => { refresh() }, [])
+
+  async function handleAdd(event) {
+    event.preventDefault()
+    const email = draftEmail.trim()
+    if (!email) return
+    setBusy(true); setError(null)
+    try {
+      await addAllowlistEmail(email, draftNote.trim() || null)
+      setDraftEmail(''); setDraftNote('')
+      await refresh()
+    } catch (e) {
+      setError(e.message)
+    } finally {
+      setBusy(false)
+    }
+  }
+
+  async function handleRemove(email) {
+    if (!confirm(`Remove ${email} from the allowlist?`)) return
+    setBusy(true); setError(null)
+    try {
+      await removeAllowlistEmail(email)
+      await refresh()
+    } catch (e) {
+      setError(e.message)
+    } finally {
+      setBusy(false)
+    }
+  }
+
+  if (data == null && !error) return <p className="muted">Loading allowlist…</p>
+
+  return (
+    <div className="admin-tab">
+      <header className="admin-tab-header">
+        <h2>Allowlist</h2>
+        <p className="muted">
+          When this list has any rows, OAuth sign-in is restricted: only emails
+          here (case-insensitive) may sign in. Already-provisioned users are
+          grandfathered by their Gitea ID and never re-checked. An empty list
+          turns the gate off entirely.
+        </p>
+        <p className="muted">
+          Status:{' '}
+          <strong>{data?.active ? 'Private beta — gate active' : 'Open — anyone can sign in'}</strong>
+        </p>
+      </header>
+      {error && <p className="settings-note warning">{error}</p>}
+
+      <form className="allowlist-add" onSubmit={handleAdd}>
+        <input
+          type="email"
+          placeholder="email@example.com"
+          value={draftEmail}
+          onChange={e => setDraftEmail(e.target.value)}
+          required
+          disabled={busy}
+        />
+        <input
+          type="text"
+          placeholder="Note (optional)"
+          value={draftNote}
+          onChange={e => setDraftNote(e.target.value)}
+          maxLength={200}
+          disabled={busy}
+        />
+        <button type="submit" className="btn-primary" disabled={busy || !draftEmail.trim()}>
+          Add to allowlist
+        </button>
+      </form>
+
+      {data?.items?.length > 0 ? (
+        <table className="admin-table">
+          <thead>
+            <tr>
+              <th>Email</th>
+              <th>Note</th>
+              <th>Added by</th>
+              <th>Added at</th>
+              <th></th>
+            </tr>
+          </thead>
+          <tbody>
+            {data.items.map(r => (
+              <tr key={r.email}>
+                <td><code>{r.email}</code></td>
+                <td>{r.note || <span className="muted">—</span>}</td>
+                <td>
+                  {r.added_by_login
+                    ? <span>@{r.added_by_login}</span>
+                    : <span className="muted">—</span>}
+                </td>
+                <td className="muted">{r.created_at}</td>
+                <td>
+                  <button
+                    type="button"
+                    className="btn-link-quiet"
+                    onClick={() => handleRemove(r.email)}
+                    disabled={busy}
+                  >Remove</button>
+                </td>
+              </tr>
+            ))}
+          </tbody>
+        </table>
+      ) : (
+        <p className="muted">
+          No allow-listed emails yet. Add the first one to put the deployment
+          into private-beta mode.
+        </p>
+      )}
+    </div>
+  )
+}
+
 // ── Graduation-readiness queue (§13.2) ─────────────────────────────────────
 
 function GraduationTab() {