Release 0.8.0: open beta-access request flow (first/last/why)

Replaces the v0.3.0 / v0.7.0 allowed_emails admission gate with an
admin-grant flow (roadmap item #6, SPEC §6.1 / §6.2 / §14.1 / §17).
Any valid email can sign in via OTC; a fresh user lands in
permission_state='pending' with a captured first/last/why profile,
and an admin grant flips them to 'granted' before write endpoints
accept them. Grandfathered users pass through the migration with
the column default 'granted' so existing contributors are unaffected.
The allowed_emails table stays in the schema as a fast-path bypass
pending v0.9.0's admin user-management page (item #7).

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

frontend/src/api.js

@@ -49,6 +49,22 @@ export async function verifyOtc(email, code) {
   return jsonOrThrow(res)
 }
 
+// ── v0.8.0: open beta-access request flow (§6.1 / §14.1) ─────────────────
+//
+// On the first OTC sign-in, the user lands in `permission_state='pending'`
+// and `/api/auth/me` reports `needs_profile=true`. The Login.jsx surface
+// then prompts for first/last/why and POSTs them here. After this lands,
+// the user sees the /beta-pending page until an admin grants access.
+
+export async function submitBetaRequest({ first_name, last_name, beta_request_reason }) {
+  const res = await fetch('/api/auth/me/beta-request', {
+    method: 'POST',
+    headers: { 'Content-Type': 'application/json' },
+    body: JSON.stringify({ first_name, last_name, beta_request_reason }),
+  })
+  return jsonOrThrow(res)
+}
+
 export async function listRFCs() {
   return jsonOrThrow(await fetch('/api/rfcs'))
 }