Release 0.3.0: private-beta gate + anonymous read mode

Adds an email allowlist (toggleable per deployment) that restricts
OAuth sign-in to listed emails while keeping read paths public.
Anonymous visitors now see the full app shell in read-only mode
instead of the §14.1 landing wall. Empty allowlist = gate off, so
deployments that don't enable it behave exactly as 0.2.3.

Also fixes single-finger scroll on /philosophy and other .chrome-pane
views on iOS Safari (.app: 100vh → 100dvh).

Renames deploy/nginx/rfc.wiggleverse.org.conf →
ohm.wiggleverse.org.conf to match the deployed-domain rename
(rfc.wiggleverse.org deprovisioned 2026-05-27).

See CHANGELOG.md for full details + upgrade steps.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

frontend/src/components/BetaPending.jsx

@@ -0,0 +1,41 @@
+// BetaPending.jsx — the post-OAuth-rejection page.
+//
+// When a deployment is in private-beta mode (i.e. its `allowed_emails`
+// table has any rows), the OAuth callback redirects unrecognised users
+// here instead of provisioning them. The framework cannot know the
+// deployment operator's preferred contact channel — so the deployment
+// supplies one via VITE_BETA_CONTACT (an email, URL, or short
+// instruction). If unset, we render a generic ask-the-operator line.
+
+import { Link } from 'react-router-dom'
+
+export default function BetaPending() {
+  const contact = import.meta.env.VITE_BETA_CONTACT || ''
+  return (
+    <div className="beta-pending">
+      <div className="beta-pending-inner">
+        <h1>{import.meta.env.VITE_APP_NAME} is in private Beta.</h1>
+        <p>
+          Discussion and contribution are gated to invited emails for now.
+          Reading is open — every super-draft, every active RFC, and every
+          public conversation is visible without signing in.
+        </p>
+        {contact ? (
+          <p className="beta-pending-contact">
+            To request access, contact <strong>{contact}</strong> with the
+            email address you'd like to sign in with.
+          </p>
+        ) : (
+          <p className="beta-pending-contact">
+            To request access, contact the deployment operator with the email
+            address you'd like to sign in with.
+          </p>
+        )}
+        <div className="beta-pending-actions">
+          <Link className="btn-primary" to="/">Browse as a guest</Link>
+          <Link className="btn-link-quiet" to="/philosophy">Read the philosophy →</Link>
+        </div>
+      </div>
+    </div>
+  )
+}