feat(web): split SPA from oikos binary, require auth on every route

Phase 0 of plans/2026-07-12-wails-desktop-app.md. The control-room SPA
is no longer embedded (web/embed.go deleted); it's a standalone static
build served separately (make ui / make deploy-ui). The api process
adds CORS and drops the dev-open auth bypass — every route now needs a
real bearer token, including SSE (?token= query param, EventSource
can't set headers) and api's own /agent proxy to nomos (previously
unauthenticated by omission).

nomos was an unauthenticated client of api's /mcp and approval-decision
endpoints; closing dev-open would have broken it, so it now sends
Authorization: Bearer $OIKOS_MCP_BEARER_TOKEN on every call back to api.

SPA gets a runtime config module (config.ts) and a Config.svelte
first-launch/reconfigure page, reachable afterwards via a "Connection"
entry in the sidebar footer. Every fetch() in api.ts routes through
fetchWithAuth so the same build works same-origin (browser prod, Vite
dev proxy) or cross-origin (future Wails webview, remote access).

Six gaps found against the plan and the live Caddy topology while
implementing — documented in the plan's "Plan review" section, most
notably: api's own /agent mount was never behind combinedAuth (fixed),
and production's Authentik forward-auth needs a bearer-token bypass for
API routes that this repo's Caddyfile.oikos reference copy now has, but
the real dtoro/caddy-conf deploy does not yet.

Verified live: cross-origin static SPA + API, CORS, bearer auth, SSE
query-token auth, and localStorage persistence all confirmed working
in-browser. Full Go test suite and npm run build pass with no
regressions against the pre-change baseline.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

compose/caddy/Caddyfile.oikos

@@ -1,8 +1,16 @@
-# Caddy reverse-proxy snippet for Oikos — Phase 6 cutover
-# Lives in dtoro/caddy-conf repo; auto-deploys to caddy (LXC 121).
-# Replaces the old MCP server on apps/105 with the Docker stack on mac-mini.
+# Caddy reverse-proxy snippet for Oikos — Phase 6 cutover, updated for the
+# client/server split (plans/2026-07-12-wails-desktop-app.md, Phase 0).
+# Lives in dtoro/caddy-conf repo; auto-deploys to caddy (LXC 121). THIS COPY
+# IS A REFERENCE, NOT DEPLOYED FROM HERE — keep it in sync manually.
+#
+# The SPA is no longer embedded in the oikos binary; it's served here as
+# static files (`make deploy-ui`). Every API/MCP/agent route now requires a
+# bearer token in all cases (api's dev-open bypass was removed) — non-browser
+# clients (Wails, curl, a future mobile client) can't complete Authentik's
+# browser-session login, so those routes bypass `import authentik` the same
+# way the enrollment endpoint always has and rely on api's own combinedAuth
+# instead. See the Wails plan's "Plan review" section, gap 1.
 
-# Oikos REST API (operator) — enrollment endpoint bypasses Authentik
 oikos.hubris.network {
     tls {
         dns ionos {env.IONOS_AUTH_API_TOKEN}
@@ -11,25 +19,36 @@ oikos.hubris.network {
     handle @enroll {
         reverse_proxy <mac-mini-mesh-ip>:8090
     }
-    # Nomos agent, same-origin for the control-room UI (EventSource/fetch can't
-    # set cross-origin auth headers). Authentik gates it; handle_path strips
-    # the /agent prefix so /agent/chat -> nomos /chat.
-    handle_path /agent/* {
-        import authentik
-        reverse_proxy <mac-mini-mesh-ip>:8092
+    # Bearer-token clients — api's combinedAuth (internal/httpapi/server.go)
+    # is the real gate for all three; Authentik would just reject non-browser
+    # callers before they ever get there. /agent/* now goes through api's own
+    # (auth'd) proxy mount rather than straight to nomos:8092, so it's
+    # covered by the same check as /api/v1/* and /mcp.
+    @api path /api/v1/* /mcp /agent/*
+    handle @api {
+        reverse_proxy <mac-mini-mesh-ip>:8090
     }
+    # Everything else: the static SPA shell. No sensitive data lives here —
+    # real enforcement is the bearer-token check above — Authentik is just a
+    # first line of defense against anonymous crawlers finding the bundle.
     handle {
         import authentik
-        reverse_proxy <mac-mini-mesh-ip>:8090
+        root * /var/www/oikos-ui
+        file_server
+        try_files {path} /index.html
     }
 }
 
-# Oikos MCP endpoint (agents) — no auth required
+# Oikos MCP endpoint (agents) — bearer token required (api's combinedAuth),
+# no separate gate here.
 mcp.hubris.network {
     reverse_proxy <mac-mini-mesh-ip>:8090
 }
 
-# Nomos gateway (workstation access) — formerly hermes.hubris.network
+# Nomos's own gateway (workstation access) — still has NO auth of its own
+# (C1, plans/2026-07-11-nomos-agent-code-review.md, still open). Anyone who
+# can reach this host can talk to nomos directly, bypassing api entirely.
+# Not fixed by the client/server split — tracked separately.
 nomos.hubris.network {
     reverse_proxy <mac-mini-mesh-ip>:8092
 }