Release 0.3.0: private-beta gate + anonymous read mode

Adds an email allowlist (toggleable per deployment) that restricts
OAuth sign-in to listed emails while keeping read paths public.
Anonymous visitors now see the full app shell in read-only mode
instead of the §14.1 landing wall. Empty allowlist = gate off, so
deployments that don't enable it behave exactly as 0.2.3.

Also fixes single-finger scroll on /philosophy and other .chrome-pane
views on iOS Safari (.app: 100vh → 100dvh).

Renames deploy/nginx/rfc.wiggleverse.org.conf →
ohm.wiggleverse.org.conf to match the deployed-domain rename
(rfc.wiggleverse.org deprovisioned 2026-05-27).

See CHANGELOG.md for full details + upgrade steps.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

frontend/src/components/RFCView.jsx

@@ -535,9 +535,10 @@ export default function RFCView({ viewer }) {
               type="button"
               className={`btn-mode-toggle ${mode}`}
               onClick={() => setMode(mode === 'discuss' ? 'contribute' : 'discuss')}
-              title={mode === 'discuss' ? 'Flip into edit mode' : 'Flip back to read-only discuss'}
+              title={mode === 'discuss' ? 'Flip into edit mode (Beta)' : 'Flip back to read-only discuss (Beta)'}
             >
               {mode === 'discuss' ? 'Contribute' : 'Discuss'}
+              <span className="beta-chip">Beta</span>
             </button>
           )}
           {(branchParam === 'main' || !canContribute) && viewer && (
@@ -547,10 +548,13 @@ export default function RFCView({ viewer }) {
               onClick={handleStartContributing}
             >
               Start Contributing
+              <span className="beta-chip">Beta</span>
             </button>
           )}
           {!viewer && (
-            <a className="btn-link" href="/auth/login">Sign in</a>
+            <a className="btn-link" href="/auth/login" title="Private beta — only invited emails can sign in">
+              Sign in <span className="beta-chip">Beta</span>
+            </a>
           )}
           {canOpenPR && (
             <button
@@ -742,7 +746,8 @@ export default function RFCView({ viewer }) {
             />
           ) : (
             <div className="readonly-bar">
-              Read-only view. <a href="/auth/login">Sign in</a> to participate.
+              Read-only view. Discussion is in private <strong>Beta</strong> —{' '}
+              <a href="/auth/login">sign in</a> if your email has been invited.
             </div>
           )}
         </div>