feat: Sign in with OTM, health, changelog, tides beacon, Ideas — first OTM release (0.4.0)

app/otm.py is the Python port of pickup's ticket verifier (HS256, mandatory
exp, audience check, alg only read to reject, never raises) plus a signed
session cookie and an in-memory single-use jti guard. portable.py gates every
route but PUBLIC_PATHS behind a session and fails CLOSED (503) with no secret
— it is a fetch proxy. /api/health reports the version, /changelog renders
CHANGELOG.md, the footer carries version/sign-out/Ideas, tides beacon from
TIDES_HOST/TIDES_SITE_ID. Dockerfile: OTM labels + HEALTHCHECK. 17 tests.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_014LCQmFvKshyAJsE8C3B5ET

CHANGELOG.md

@@ -0,0 +1,9 @@
+# Changelog — 13ft (OTM fork)
+
+## 0.4.0 — 2026-10-18
+
+First OTM release of the fork (upstream wasi-master/13ft 0.3.4 underneath).
+
+- Sign in with OTM replaces Caddy basic auth: every fetch route needs an OTM session (grant on `app:13ft`); no secret configured = the app refuses everyone rather than becoming an open proxy.
+- `/api/health` reports the version; `/changelog` renders this file; a footer with version, sign-out and an Ideas box that files a Gitea issue.
+- tides beacon when the platform injects `TIDES_HOST`/`TIDES_SITE_ID`.