Release 0.7.0: email/OTC sign-in (Gitea OAuth retained as fallback)

Replaces the Gitea OAuth gesture as the primary human-auth path
(roadmap item #5, SPEC §6.2). Users sign in by entering their email,
receiving a six-digit code via the existing SMTP layer, and entering
the code on a two-step /login surface. The Gitea OAuth callback
remains functional during migration — the new UI links to it as a
fallback for users with active OAuth sessions or older invite paths
— and is scheduled for removal in a future release once OTC adoption
is universal. Existing users are linked by email on first OTC sign-
in (gitea_id preserved); new users are provisioned with NULL
gitea_id and rely on email as the identity key. The migration
introduces backend/migrations/012_otc.sql (otc_codes table + users
schema rebuild for nullable gitea_id and a partial unique index on
email), two new endpoints (POST /auth/otc/request, POST /auth/otc/verify),
bcrypt as a new backend dependency for code hashing, and 11 new
tests in test_otc_vertical.py covering the happy path, expired and
consumed and wrong codes, the per-email rate limit, the allowlist
gate, the OAuth-era link path, fresh provisioning, and prior-code
invalidation on re-request. No new secrets are required — the
existing SECRET_KEY signs sessions and bcrypt's per-row salt covers
the code hashes.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

frontend/src/App.jsx

@@ -8,6 +8,7 @@ import PRView from './components/PRView.jsx'
 import ProposalView from './components/ProposalView.jsx'
 import ProposeModal from './components/ProposeModal.jsx'
 import Landing from './components/Landing.jsx'
+import Login from './components/Login.jsx'
 import BetaPending from './components/BetaPending.jsx'
 import Philosophy from './components/Philosophy.jsx'
 import NotificationSettings from './components/NotificationSettings.jsx'
@@ -121,15 +122,16 @@ export default function App() {
               <a className="btn-link" href="/auth/logout">Sign out</a>
             </>
           ) : (
-            <a className="btn-signin-header" href="/auth/login" title="Private beta — only invited emails can sign in">
+            <Link className="btn-signin-header" to="/login" title="Private beta — only invited emails can sign in">
               Sign in <span className="beta-chip">Beta</span>
-            </a>
+            </Link>
           )}
         </div>
       </header>
       <div className="app-body">
         <Routes>
           <Route path="/welcome" element={<Landing />} />
+          <Route path="/login" element={<Login />} />
           <Route path="/beta-pending" element={<BetaPending />} />
           <Route path="/philosophy" element={<PhilosophyWithSidebar viewer={viewer} />} />
           {viewer && (
@@ -216,7 +218,7 @@ function Welcome({ viewer }) {
         </p>
         <p>
           Discussion and contribution are in private <strong>Beta</strong> —
-          read freely, and <a href="/auth/login">sign in</a> if your email has
+          read freely, and <Link to="/login">sign in</Link> if your email has
           been invited.
         </p>
         <p>