Release 0.3.0: private-beta gate + anonymous read mode

Adds an email allowlist (toggleable per deployment) that restricts
OAuth sign-in to listed emails while keeping read paths public.
Anonymous visitors now see the full app shell in read-only mode
instead of the §14.1 landing wall. Empty allowlist = gate off, so
deployments that don't enable it behave exactly as 0.2.3.

Also fixes single-finger scroll on /philosophy and other .chrome-pane
views on iOS Safari (.app: 100vh → 100dvh).

Renames deploy/nginx/rfc.wiggleverse.org.conf →
ohm.wiggleverse.org.conf to match the deployed-domain rename
(rfc.wiggleverse.org deprovisioned 2026-05-27).

See CHANGELOG.md for full details + upgrade steps.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

frontend/src/components/Catalog.jsx

@@ -22,7 +22,7 @@ const SORT_OPTIONS = [
   { id: 'state',   label: 'State' },
 ]
 
-export default function Catalog({ onProposeRFC, version }) {
+export default function Catalog({ viewer, onProposeRFC, version }) {
   const [rfcs, setRfcs] = useState([])
   const [proposals, setProposals] = useState([])
   const [search, setSearch] = useState('')
@@ -93,7 +93,7 @@ export default function Catalog({ onProposeRFC, version }) {
         {filtered.length === 0 ? (
           <div style={{ padding: '24px 14px', color: '#999', fontSize: 13 }}>
             {rfcs.length === 0
-              ? 'No RFCs in the catalog yet. Propose one below.'
+              ? (viewer ? 'No RFCs in the catalog yet. Propose one below.' : 'No RFCs in the catalog yet.')
               : 'No matches.'}
           </div>
         ) : (
@@ -148,7 +148,13 @@ export default function Catalog({ onProposeRFC, version }) {
       </div>
 
       <div className="catalog-footer">
-        <button className="btn-propose" onClick={onProposeRFC}>+ Propose New RFC</button>
+        {viewer ? (
+          <button className="btn-propose" onClick={onProposeRFC}>+ Propose New RFC</button>
+        ) : (
+          <a className="btn-propose" href="/auth/login" title="Private beta — only invited emails can propose">
+            Sign in to propose <span className="beta-chip">Beta</span>
+          </a>
+        )}
       </div>
     </aside>
   )