feat: Sign in with OTM, health, changelog, tides beacon, Ideas — first OTM release (0.4.0)

app/otm.py is the Python port of pickup's ticket verifier (HS256, mandatory
exp, audience check, alg only read to reject, never raises) plus a signed
session cookie and an in-memory single-use jti guard. portable.py gates every
route but PUBLIC_PATHS behind a session and fails CLOSED (503) with no secret
— it is a fetch proxy. /api/health reports the version, /changelog renders
CHANGELOG.md, the footer carries version/sign-out/Ideas, tides beacon from
TIDES_HOST/TIDES_SITE_ID. Dockerfile: OTM labels + HEALTHCHECK. 17 tests.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_014LCQmFvKshyAJsE8C3B5ET

Dockerfile

@@ -7,12 +7,12 @@ ARG GID=1000
 RUN addgroup -g $GID thirteener
 RUN adduser -D -g '' -u $UID -G thirteener thirteener
 
-# Generic labels
-LABEL maintainer="Arian Mollik Wasi <arianmollik323@gmail.com>"
-LABEL version="0.3.4"
-LABEL description="My own custom 12ft.io replacement"
-LABEL url="https://github.com/wasi-master/13ft/"
-LABEL documentation="https://github.com/wasi-master/13ft/blob/main/README.md"
+# Generic labels (OTM fork of wasi-master/13ft 0.3.4 — see CLAUDE.md)
+LABEL maintainer="Powered by OTM <tony@poweredbyotm.com>"
+LABEL version="0.4.0"
+LABEL description="13ft (OTM fork): read the article without the cruft, behind Sign in with OTM"
+LABEL url="https://git.poweredbyotm.com/tonym/13ft"
+LABEL documentation="https://git.poweredbyotm.com/tonym/13ft/src/branch/main/CLAUDE.md"
 
 # OCI compliant labels
 LABEL org.opencontainers.image.source="https://github.com/wasi-master/13ft"
@@ -34,4 +34,7 @@ RUN --mount=type=cache,mode=0755,target=/home/thirteener/.cache/pip \
 
 WORKDIR /app
 EXPOSE 5000
+# /api/health is one of the few unauthenticated routes (app/otm.py PUBLIC_PATHS).
+HEALTHCHECK --interval=30s --timeout=5s --start-period=15s --retries=3 \
+  CMD wget -qO- http://127.0.0.1:5000/api/health || exit 1
 CMD [ "python", "-m", "gunicorn", "portable:app" ]