feat(web): split SPA from oikos binary, require auth on every route

Phase 0 of plans/2026-07-12-wails-desktop-app.md. The control-room SPA
is no longer embedded (web/embed.go deleted); it's a standalone static
build served separately (make ui / make deploy-ui). The api process
adds CORS and drops the dev-open auth bypass — every route now needs a
real bearer token, including SSE (?token= query param, EventSource
can't set headers) and api's own /agent proxy to nomos (previously
unauthenticated by omission).

nomos was an unauthenticated client of api's /mcp and approval-decision
endpoints; closing dev-open would have broken it, so it now sends
Authorization: Bearer $OIKOS_MCP_BEARER_TOKEN on every call back to api.

SPA gets a runtime config module (config.ts) and a Config.svelte
first-launch/reconfigure page, reachable afterwards via a "Connection"
entry in the sidebar footer. Every fetch() in api.ts routes through
fetchWithAuth so the same build works same-origin (browser prod, Vite
dev proxy) or cross-origin (future Wails webview, remote access).

Six gaps found against the plan and the live Caddy topology while
implementing — documented in the plan's "Plan review" section, most
notably: api's own /agent mount was never behind combinedAuth (fixed),
and production's Authentik forward-auth needs a bearer-token bypass for
API routes that this repo's Caddyfile.oikos reference copy now has, but
the real dtoro/caddy-conf deploy does not yet.

Verified live: cross-origin static SPA + API, CORS, bearer auth, SSE
query-token auth, and localStorage persistence all confirmed working
in-browser. Full Go test suite and npm run build pass with no
regressions against the pre-change baseline.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

web/src/pages/Config.svelte

@@ -0,0 +1,96 @@
+<script lang="ts">
+  import * as Card from '$lib/components/ui/card'
+  import * as Tabs from '$lib/components/ui/tabs'
+  import { Input } from '$lib/components/ui/input'
+  import { Label } from '$lib/components/ui/label'
+  import { Button } from '$lib/components/ui/button'
+  import { fetchWithAuth, setConfig, initConfig, getConfig, clearConfig } from '$lib/config'
+
+  let { onConnected, onCancel }: { onConnected: () => void; onCancel?: () => void } = $props()
+
+  const existing = getConfig()
+  let apiUrl = $state(existing.apiUrl ?? '')
+  let token = $state(existing.token ?? '')
+  let connecting = $state(false)
+  let error = $state('')
+
+  function disconnect() {
+    clearConfig()
+    apiUrl = ''
+    token = ''
+    error = ''
+  }
+
+  async function connect() {
+    error = ''
+    if (!token.trim()) {
+      error = 'Token is required'
+      return
+    }
+    connecting = true
+    setConfig({ apiUrl: apiUrl.trim(), token: token.trim() })
+    initConfig({ apiUrl: apiUrl.trim(), token: token.trim() })
+    try {
+      const res = await fetchWithAuth('/api/v1/dashboard/summary')
+      if (!res.ok) {
+        error = res.status === 401 ? 'Invalid token' : `Server responded ${res.status}`
+        return
+      }
+      onConnected()
+    } catch (e) {
+      error = 'Could not reach server — check the URL'
+    } finally {
+      connecting = false
+    }
+  }
+</script>
+
+<div class="flex h-svh items-center justify-center p-6">
+  <Card.Root class="w-full max-w-md">
+    <Card.Header>
+      <Card.Title>Connect to Oikos</Card.Title>
+      <Card.Description>Enter the server URL and your access token.</Card.Description>
+    </Card.Header>
+    <Card.Content>
+      <Tabs.Root value="token">
+        <Tabs.List class="mb-4 grid w-full grid-cols-2">
+          <Tabs.Trigger value="token">Token</Tabs.Trigger>
+          <Tabs.Trigger value="oidc" disabled>Login with Authentik (coming soon)</Tabs.Trigger>
+        </Tabs.List>
+        <Tabs.Content value="token">
+          <form class="flex flex-col gap-4" onsubmit={(e) => { e.preventDefault(); connect() }}>
+            <div class="flex flex-col gap-1.5">
+              <Label for="server-url">Server URL</Label>
+              <Input
+                id="server-url"
+                type="url"
+                placeholder="https://oikos.hubris.network (leave blank if same-origin)"
+                bind:value={apiUrl}
+              />
+            </div>
+            <div class="flex flex-col gap-1.5">
+              <Label for="token">Token</Label>
+              <Input id="token" type="password" placeholder="bearer token" bind:value={token} />
+            </div>
+            {#if error}
+              <p class="text-sm text-destructive">{error}</p>
+            {/if}
+            <div class="flex gap-2">
+              <Button type="submit" disabled={connecting} class="flex-1">
+                {connecting ? 'Connecting…' : 'Connect'}
+              </Button>
+              {#if onCancel}
+                <Button type="button" variant="outline" onclick={onCancel}>Cancel</Button>
+              {/if}
+            </div>
+            {#if existing.token}
+              <Button type="button" variant="ghost" size="sm" onclick={disconnect}>
+                Forget saved connection
+              </Button>
+            {/if}
+          </form>
+        </Tabs.Content>
+      </Tabs.Root>
+    </Card.Content>
+  </Card.Root>
+</div>