feat(web): split SPA from oikos binary, require auth on every route

Phase 0 of plans/2026-07-12-wails-desktop-app.md. The control-room SPA
is no longer embedded (web/embed.go deleted); it's a standalone static
build served separately (make ui / make deploy-ui). The api process
adds CORS and drops the dev-open auth bypass — every route now needs a
real bearer token, including SSE (?token= query param, EventSource
can't set headers) and api's own /agent proxy to nomos (previously
unauthenticated by omission).

nomos was an unauthenticated client of api's /mcp and approval-decision
endpoints; closing dev-open would have broken it, so it now sends
Authorization: Bearer $OIKOS_MCP_BEARER_TOKEN on every call back to api.

SPA gets a runtime config module (config.ts) and a Config.svelte
first-launch/reconfigure page, reachable afterwards via a "Connection"
entry in the sidebar footer. Every fetch() in api.ts routes through
fetchWithAuth so the same build works same-origin (browser prod, Vite
dev proxy) or cross-origin (future Wails webview, remote access).

Six gaps found against the plan and the live Caddy topology while
implementing — documented in the plan's "Plan review" section, most
notably: api's own /agent mount was never behind combinedAuth (fixed),
and production's Authentik forward-auth needs a bearer-token bypass for
API routes that this repo's Caddyfile.oikos reference copy now has, but
the real dtoro/caddy-conf deploy does not yet.

Verified live: cross-origin static SPA + API, CORS, bearer auth, SSE
query-token auth, and localStorage persistence all confirmed working
in-browser. Full Go test suite and npm run build pass with no
regressions against the pre-change baseline.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

web/src/App.svelte

@@ -8,9 +8,11 @@
   import EntityDetail from './pages/EntityDetail.svelte'
   import Knowledge from './pages/Knowledge.svelte'
   import Learning from './pages/Learning.svelte'
+  import Config from './pages/Config.svelte'
   import { newChat } from '$lib/stores/chat'
   import { summary, subscribeContext, openSignalCount } from '$lib/stores/context'
   import { connectionState } from '$lib/stores/events'
+  import { isConfigured } from '$lib/config'
   import { onMount } from 'svelte'
   import * as Sidebar from '$lib/components/ui/sidebar'
   import * as Sheet from '$lib/components/ui/sheet'
@@ -27,10 +29,12 @@
   import NetworkIcon from '@lucide/svelte/icons/share-2'
   import SearchIcon from '@lucide/svelte/icons/search'
   import TrendingUpIcon from '@lucide/svelte/icons/trending-up'
+  import SettingsIcon from '@lucide/svelte/icons/settings'
 
   let page = $state('overview')
   let routeParam = $state('')
   let drawerOpen = $state(false)
+  let configured = $state(isConfigured())
 
   const approvalsPending = $derived($summary?.approvals_pending ?? 0)
   const openSignals = $derived(openSignalCount($summary))
@@ -44,12 +48,14 @@
     }
     sync()
     window.addEventListener('hashchange', sync)
-    const unsubscribeCtx = subscribeContext()
+    return () => window.removeEventListener('hashchange', sync)
+  })
 
-    return () => {
-      window.removeEventListener('hashchange', sync)
-      unsubscribeCtx()
-    }
+  // Context (dashboard summary + approvals poll) and the SSE stream both
+  // authenticate — don't subscribe until a token exists.
+  $effect(() => {
+    if (!configured) return
+    return subscribeContext()
   })
 
   function navigate(p: string) {
@@ -67,6 +73,13 @@
   ]
 </script>
 
+{#if !configured}
+  <Config
+    onConnected={() => (configured = true)}
+    onCancel={isConfigured() ? () => (configured = true) : undefined}
+  />
+{:else}
+
 <Toaster />
 
 <Sidebar.Provider class="h-svh" style="--header-height: calc(var(--spacing) * 12);">
@@ -145,6 +158,16 @@
         <PanelRightIcon />
         <span>Chat drawer</span>
       </Button>
+      <Button
+        variant="ghost"
+        size="sm"
+        class="justify-start gap-2"
+        onclick={() => (configured = false)}
+        title="Server connection settings"
+      >
+        <SettingsIcon />
+        <span>Connection</span>
+      </Button>
     </Sidebar.Footer>
   </Sidebar.Root>
 
@@ -218,3 +241,5 @@
     </div>
   </Sheet.Content>
 </Sheet.Root>
+
+{/if}