feat(web): split SPA from oikos binary, require auth on every route

Phase 0 of plans/2026-07-12-wails-desktop-app.md. The control-room SPA
is no longer embedded (web/embed.go deleted); it's a standalone static
build served separately (make ui / make deploy-ui). The api process
adds CORS and drops the dev-open auth bypass — every route now needs a
real bearer token, including SSE (?token= query param, EventSource
can't set headers) and api's own /agent proxy to nomos (previously
unauthenticated by omission).

nomos was an unauthenticated client of api's /mcp and approval-decision
endpoints; closing dev-open would have broken it, so it now sends
Authorization: Bearer $OIKOS_MCP_BEARER_TOKEN on every call back to api.

SPA gets a runtime config module (config.ts) and a Config.svelte
first-launch/reconfigure page, reachable afterwards via a "Connection"
entry in the sidebar footer. Every fetch() in api.ts routes through
fetchWithAuth so the same build works same-origin (browser prod, Vite
dev proxy) or cross-origin (future Wails webview, remote access).

Six gaps found against the plan and the live Caddy topology while
implementing — documented in the plan's "Plan review" section, most
notably: api's own /agent mount was never behind combinedAuth (fixed),
and production's Authentik forward-auth needs a bearer-token bypass for
API routes that this repo's Caddyfile.oikos reference copy now has, but
the real dtoro/caddy-conf deploy does not yet.

Verified live: cross-origin static SPA + API, CORS, bearer auth, SSE
query-token auth, and localStorage persistence all confirmed working
in-browser. Full Go test suite and npm run build pass with no
regressions against the pre-change baseline.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

web/src/lib/config.ts

@@ -0,0 +1,92 @@
+// Runtime configuration for the SPA — server URL + auth token. Every fetch
+// call goes through fetchWithAuth/apiBase (used by api.ts) so the SPA works
+// identically whether it's served same-origin (browser prod, Vite dev proxy)
+// or cross-origin (Wails webview, remote access). See
+// plans/2026-07-12-wails-desktop-app.md 0.2.
+
+export interface OikosConfig {
+  apiUrl: string // e.g. "https://oikos.hubris.network", or "" for same-origin
+  token?: string // bearer token for auth
+}
+
+declare global {
+  interface Window {
+    __OIKOS_CONFIG__?: OikosConfig
+  }
+}
+
+let cfg: OikosConfig | undefined
+
+export function initConfig(override?: OikosConfig) {
+  cfg = override ?? window.__OIKOS_CONFIG__
+  if (cfg?.token) {
+    localStorage.setItem('oikos_token', cfg.token)
+    if (cfg.apiUrl) localStorage.setItem('oikos_api_url', cfg.apiUrl)
+  }
+}
+
+export function getConfig(): OikosConfig {
+  if (!cfg) {
+    const token = localStorage.getItem('oikos_token')
+    const apiUrl = localStorage.getItem('oikos_api_url')
+    if (token || apiUrl) {
+      cfg = { apiUrl: apiUrl ?? '', token: token ?? undefined }
+    }
+  }
+  return cfg ?? { apiUrl: '' }
+}
+
+export function setConfig(next: OikosConfig) {
+  cfg = next
+  if (next.token) localStorage.setItem('oikos_token', next.token)
+  else localStorage.removeItem('oikos_token')
+  if (next.apiUrl) localStorage.setItem('oikos_api_url', next.apiUrl)
+  else localStorage.removeItem('oikos_api_url')
+}
+
+export function clearConfig() {
+  cfg = { apiUrl: '' }
+  localStorage.removeItem('oikos_token')
+  localStorage.removeItem('oikos_api_url')
+}
+
+export function isConfigured(): boolean {
+  return !!getConfig().token
+}
+
+// Relative paths are used in dev (Vite proxy) and when the SPA shares an
+// origin with the API server (Caddy reverse proxy). Absolute paths are used
+// when the API server is on a different origin (Wails webview, remote access).
+export function apiBase(path: string): string {
+  const c = getConfig()
+  if (!c.apiUrl) return path // relative — relies on same-origin or Vite proxy
+  return `${c.apiUrl}${path}`
+}
+
+// ---- Auth fetch wrapper ----
+// Prepends the API base URL (absolute when configured, relative when unset
+// for the Vite dev proxy / same-origin prod) and adds the Authorization
+// header. Used by every fetch call in api.ts.
+export async function fetchWithAuth(path: string, opts?: RequestInit): Promise<Response> {
+  const headers: Record<string, string> = {
+    'Content-Type': 'application/json',
+    ...(opts?.headers as Record<string, string> ?? {})
+  }
+  const c = getConfig()
+  if (c.token) {
+    headers['Authorization'] = `Bearer ${c.token}`
+  }
+
+  return fetch(apiBase(path), { ...opts, headers })
+}
+
+// SSE path builder — EventSource doesn't take headers, so pass the token as
+// a query parameter (the SSE handler's combinedAuth checks it alongside the
+// Authorization header, only for this route).
+export function sseUrl(path: string): string {
+  const c = getConfig()
+  const url = apiBase(path)
+  if (!c.token) return url
+  const sep = url.includes('?') ? '&' : '?'
+  return `${url}${sep}token=${encodeURIComponent(c.token)}`
+}