oikos-web: extract the client stack from dtoro/oikos

Phase 1 of the hexagonal-architecture plan (dtoro/oikos
plans/2026-08-15-hexagonal-architecture.md). Moves the delivery stack
for the control-room UI into its own repo with its own pipeline:

- web/ — Svelte 5 SPA, verbatim (vendor/ included)
- desktop/ — Wails v3 wrapper, updateURL repointed to
  dtoro/oikos-web releases
- compose/ — Dockerfile + Caddyfile, verbatim (the /wails/* 404 and
  asset no-fallback quirks are load-bearing)
- docker-compose.yml — single web service, same 8091:80 publish,
  mem/cpu limits, and restart policy as the oikos stack's web service
- scripts/deploy.sh — mirrors oikos deploy essentials: CI-green gate,
  TOCTOU guard, version-tagged oikos-web:v$VERSION, prune to 3
- cmd/webhook + scripts/install-webhook.sh — standalone push-to-deploy
  receiver on :9798 (env-only secrets, no Infisical dependency)
- CI: the web job from oikos's ci.yml + the desktop build/release
  workflow, path-adjusted

Own VERSION (0.33.0) with the same bump-on-main rule; starts above
oikos's 0.32.x so the desktop updater sees an upgrade.

web/vite.config.ts

@@ -0,0 +1,97 @@
+/// <reference types="vitest/config" />
+import type { ProxyOptions } from 'vite'
+import { svelte } from '@sveltejs/vite-plugin-svelte'
+import tailwindcss from '@tailwindcss/vite'
+import { readFileSync, existsSync } from 'fs'
+import { fileURLToPath, URL } from 'node:url'
+import { defineConfig } from 'vite'
+
+// In Docker, VERSION is copied into the build WORKDIR (/build/web/VERSION).
+// In local dev, the cwd is web/ and VERSION is two dirs up (../../VERSION
+// from vite.config.ts location in web/). Try both.
+let version: string
+if (existsSync('../VERSION')) {
+  version = readFileSync('../VERSION', 'utf-8').trim()
+} else {
+  version = readFileSync('VERSION', 'utf-8').trim()
+}
+
+// Injects OIKOS_API_TOKEN into proxied /api requests in dev — the API no
+// longer has a dev-open bypass (plans/2026-07-12-wails-desktop-app.md 0.4),
+// so `OIKOS_API_TOKEN=dev-token npm run dev` needs this to reach it.
+function authProxy(target: string, rewrite?: (path: string) => string): ProxyOptions {
+  return {
+    target,
+    ...(rewrite ? { rewrite } : {}),
+    configure: (proxy) => {
+      proxy.on('proxyReq', (proxyReq) => {
+        const token = process.env.OIKOS_API_TOKEN
+        if (token) proxyReq.setHeader('Authorization', `Bearer ${token}`)
+      })
+    }
+  }
+}
+
+// Where `npm run dev` proxies to. The SPA is hardwired to same-origin in dev
+// (see the __OIKOS_DEV_TOKEN__ define below), so these targets — not
+// localStorage — decide which backend a dev session actually talks to. They
+// default to the local prod stack, which is what you want day to day; override
+// them to point a dev SPA at a scratch API without touching this file:
+//
+//   OIKOS_API_PROXY=http://127.0.0.1:8199 npm run dev
+const apiTarget = process.env.OIKOS_API_PROXY ?? 'http://localhost:8090'
+const nomosTarget = process.env.OIKOS_NOMOS_PROXY ?? 'http://localhost:8092'
+
+export default defineConfig({
+  plugins: [tailwindcss(), svelte()],
+  base: '/',
+  define: {
+    __OIKOS_VERSION__: JSON.stringify(`v${version}`),
+    // Lets the dev server auto-configure the SPA with the same token it
+    // already injects into proxied requests (see authProxy above), so `npm
+    // run dev` skips the "Connect to Oikos" prompt instead of re-asking for
+    // a token every time localStorage gets cleared. Empty string (never a
+    // real prod secret — see main.ts, only consulted in import.meta.env.DEV)
+    // when OIKOS_API_TOKEN isn't set, so the prompt still shows if unconfigured.
+    __OIKOS_DEV_TOKEN__: JSON.stringify(process.env.OIKOS_API_TOKEN ?? '')
+  },
+  resolve: {
+    alias: {
+      $lib: '/src/lib',
+      // svelte-splitpanes imports SvelteKit's browser-detection module; this
+      // isn't a SvelteKit app, so point it at a plain shim (see the file).
+      // Needs a real filesystem path (not the /src/... shorthand $lib uses)
+      // so esbuild's dependency pre-bundler can resolve it too.
+      '$app/environment': fileURLToPath(
+        new URL('./src/lib/shims/app-environment.ts', import.meta.url)
+      )
+    }
+  },
+  build: {
+    outDir: 'dist',
+    emptyOutDir: true
+  },
+  optimizeDeps: {
+    // svelte-splitpanes imports SvelteKit's $app/environment (aliased above
+    // to a shim), but esbuild's dependency pre-bundler resolves that
+    // differently and fails before the dev server even starts — skip
+    // pre-bundling it so it goes through Vite's normal (alias-aware)
+    // transform pipeline instead.
+    exclude: ['svelte-splitpanes']
+  },
+  server: {
+    proxy: {
+      '/api': authProxy(apiTarget),
+      // Production Caddy strips /agent before forwarding to nomos
+      // (compose/caddy/Caddyfile.oikos handle_path /agent/*); match that
+      // here so dev and prod agree on nomos's actual route paths.
+      '/agent': authProxy(nomosTarget, (path) => path.replace(/^\/agent/, ''))
+    }
+  },
+  test: {
+    environment: 'jsdom',
+    globals: true,
+    setupFiles: ['src/test-setup.ts'],
+    include: ['src/**/*.{test,spec}.{ts,js}']
+  }
+})