oikos-web: extract the client stack from dtoro/oikos

Phase 1 of the hexagonal-architecture plan (dtoro/oikos
plans/2026-08-15-hexagonal-architecture.md). Moves the delivery stack
for the control-room UI into its own repo with its own pipeline:

- web/ — Svelte 5 SPA, verbatim (vendor/ included)
- desktop/ — Wails v3 wrapper, updateURL repointed to
  dtoro/oikos-web releases
- compose/ — Dockerfile + Caddyfile, verbatim (the /wails/* 404 and
  asset no-fallback quirks are load-bearing)
- docker-compose.yml — single web service, same 8091:80 publish,
  mem/cpu limits, and restart policy as the oikos stack's web service
- scripts/deploy.sh — mirrors oikos deploy essentials: CI-green gate,
  TOCTOU guard, version-tagged oikos-web:v$VERSION, prune to 3
- cmd/webhook + scripts/install-webhook.sh — standalone push-to-deploy
  receiver on :9798 (env-only secrets, no Infisical dependency)
- CI: the web job from oikos's ci.yml + the desktop build/release
  workflow, path-adjusted

Own VERSION (0.33.0) with the same bump-on-main rule; starts above
oikos's 0.32.x so the desktop updater sees an upgrade.

README.md

@@ -0,0 +1,50 @@
+# oikos-web
+
+The Oikos control-room client: the Svelte 5 SPA (`web/`), the Wails v3
+desktop wrapper (`desktop/`), and the delivery stack that serves it
+(`compose/`, `docker-compose.yml`, `scripts/deploy.sh`).
+
+Extracted from [dtoro/oikos](https://git.hubris.network/dtoro/oikos) in
+Phase 1 of the hexagonal-architecture refactor
+(plans/2026-08-15-hexagonal-architecture.md in that repo). The backend
+(API, MCP, scheduler) stays in dtoro/oikos — this repo talks to it over
+REST/SSE only.
+
+## Layout
+
+```
+web/                Control-room SPA (Svelte 5, Vite)
+desktop/            Wails v3 desktop wrapper (macOS + Linux)
+compose/            Dockerfile + Caddyfile for the oikos-web image
+cmd/webhook/        Deploy-webhook receiver (Gitea push → deploy)
+scripts/deploy.sh   Deploy script (CI-green gate, versioned images)
+docker-compose.yml  The single `web` service, publishing 8091:80
+```
+
+## Dev
+
+```bash
+cd web && OIKOS_API_TOKEN=dev-token npm run dev   # proxies to api :8090/:8092
+make desktop                                       # build the desktop app
+```
+
+The SPA's first-launch Config screen stores the server URL + token; the
+backend version is available via the API ping — the sidebar shows this
+repo's VERSION.
+
+## Versioning
+
+Own `VERSION` file with the same rule as oikos: every commit to `main`
+bumps it (patch for fixes, minor for features). The version tag is shown
+in the SPA sidebar and stamped into desktop builds.
+
+## Deploy
+
+Push to `main` → Gitea webhook → `cmd/webhook` receiver →
+`scripts/deploy.sh`: waits for CI green, builds `oikos-web:v$VERSION` from
+the working tree, `docker compose up -d`, prunes to the 3 newest tags.
+Rollback: `OIKOS_VERSION=v0.x.y docker compose up -d`.
+
+Desktop auto-update reads this repo's Gitea releases. Builds installed
+before the extraction point at dtoro/oikos and need one manual reinstall
+(see the first release notes).