feat: Phase 1 — extract the client (web SPA + desktop) to dtoro/oikos-web

Problem: the hexagonal refactor churns the backend tree for nine more
phases; the UI delivery stack (web/ SPA, cmd/desktop Wails wrapper,
compose/web image) must move to its own repo first so doc/layout
rewrites land once on a backend-only tree.

Change:
- New repo git.hubris.network/dtoro/oikos-web (v0.33.0): web/, desktop/
  (updateURL repointed to oikos-web releases), compose/, own CI (web +
  desktop jobs), own deploy script (CI-green gate, TOCTOU guard,
  version-tagged images, prune-to-3), own webhook receiver on :9798 +
  launchd unit, own compose project publishing the same 8091:80.
- Cutover executed on mac-mini in order: oikos stack's web service
  stopped+removed, oikos-web project brought up on 8091; outer Caddy
  untouched (targets the published port) — serving + Authentik flow +
  /wails 404 quirk verified post-cutover.
- Stripped from oikos: web/, cmd/desktop/, compose/web/, desktop CI
  workflow, ci.yml web job, Makefile ui/desktop/desktop-package/install
  targets, the compose web service, oikos-web from deploy.sh's fallback
  prune list; wails + go-keyring dropped from go.mod, vendor synced.
- README / CONTRIBUTING / AGENTS.md / .agents dev+operations docs now
  point at the new repo; mbse + mascot design docs carry a path note.

Risk: production SPA serving depends on the new pipeline now; rollback
is versioned-image re-up of the old web service from a pre-split
checkout (port 8091). Desktop builds installed before the split still
check dtoro/oikos releases — one manual reinstall, noted in the
oikos-web release notes.

Verification: go vet, make test (race), make generate-check, golangci
(no new findings; baseline down 400→365); post-cutover curls —
localhost:8091 200, /wails/runtime.js 404, outer Caddy 302 Authentik.

CONTRIBUTING.md

@@ -9,8 +9,9 @@ repo, see [.agents/dev/CONTRIBUTING.md](.agents/dev/CONTRIBUTING.md).
 - **Go 1.26+** (see `go.mod` for pinned version)
 - **PostgreSQL with TimescaleDB** — the compose stack includes `timescale/timescaledb:2.17.2-pg16`
 - **Docker** for the full dev stack
-- **Node 22+** for `web/` (the control-room SPA — standalone, not part of the
-  compose stack or the `oikos` binary)
+- The control-room SPA and desktop app live in their own repo —
+  [dtoro/oikos-web](https://git.hubris.network/dtoro/oikos-web) (Node 22+
+  there); this repo is backend-only since the hexagonal refactor Phase 1
 
 ```bash
 # Start dependencies (Postgres + Redis). api/nomos require a shared bearer
@@ -26,44 +27,24 @@ make test-db
 # Build the binary
 make build
 
-# SPA dev server (proxies to api/nomos, injecting the same token)
-cd web && OIKOS_API_TOKEN=dev-token npm run dev
+# SPA dev server (own repo — dtoro/oikos-web)
+cd ~/Projects/oikos-web/web && OIKOS_API_TOKEN=dev-token npm run dev
 
-# Desktop app (macOS)
-make desktop                  # build .app bundle
-make install                  # build + install to /Applications
-./cmd/desktop/build/bin/oikos-desktop.app/Contents/MacOS/oikos-desktop  # run from terminal to see logs
+# Desktop app (macOS — also in the oikos-web repo)
+cd ~/Projects/oikos-web && make install
 ```
 
-### Desktop app auth
+### Desktop app
 
-The desktop app uses the same API as the browser SPA. First launch:
-
-1. Enter `https://oikos.hubris.network` as Server URL
-2. **Login with Authentik** tab → opens system browser → authenticate
-3. Callback page shows token → copy → paste into Token tab → Connect
-4. Token is persisted to the macOS keychain — subsequent launches skip setup
-
-The app stores credentials via `github.com/zalando/go-keyring` (service: `com.hubris.oikos-desktop`).
-
-### Desktop app auto-update
-
-- Checks Gitea releases every 6 hours
-- System tray → **Check for Updates** triggers an immediate check
-- Download, extract, replace the app in `/Applications`, and relaunch
-- Versions are compared against the `version` var in `main.go`, injected from the repo `VERSION` file at link time (`make desktop` passes `-ldflags "-X main.version=$(cat VERSION)"`)
+The desktop app's auth (Authentik login → keychain-persisted token) and
+auto-update (Gitea releases every 6 hours) moved with it to
+[dtoro/oikos-web](https://git.hubris.network/dtoro/oikos-web) — see that
+repo's README. Auto-update now tracks oikos-web releases; builds installed
+before the split need one manual reinstall.
 
 ## Project structure
 
 ```
-cmd/desktop/        Wails v3 desktop app (macOS + Linux)
-  main.go            Thin shell: webview, system tray, notifications, auto-update
-  wails.json         Wails project config
-  entitlements.plist macOS code-signing entitlements
-  icon.png           System tray icon (embedded)
-  icon.icns          App bundle icon (white logo on black rounded rect)
-  Taskfile.yml       Wails v3 build tasks
-  Info.plist.template macOS bundle metadata
 cmd/oikos/          Single-binary entry point
 cmd/nomos/          Nomos MCP client gateway
 cmd/webhook/        Gitea deploy-webhook receiver (push-to-deploy on mac-mini)
@@ -87,8 +68,6 @@ internal/           All Go packages
   secrets/          Infisical + SOPS backend
   ontology/         Type hierarchy, relationship validation
   knowledge/        Knowledge YAML seed ingestion
-web/                Control-room SPA (Svelte 5) — standalone, not embedded
-                    in the oikos binary; see plans/2026-07-12-wails-desktop-app.md
 api/openapi.yaml    API contract — the source of truth for endpoints
 migrations/         Forward-only SQL migrations (TimescaleDB)
 seeds/              Bootstrap YAML: ontology, inventory, policy, knowledge
@@ -118,11 +97,6 @@ docs/operations/    Runbooks (rollback, etc.)
 | `make export` | Export DB state to YAML seeds |
 | `make dev` | Start compose dev stack |
 | `make clean` | Remove binary + test cache |
-| `make ui` | Build the SPA (`web/dist/`) |
-| `make deploy-ui` | Build + deploy the SPA to the Caddy host |
-| `make desktop` | Build the Wails desktop app for the current platform |
-| `make desktop-package` | Build + package (zip on macOS, tar.gz on Linux) |
-| `make install` | Build + install to `/Applications` (macOS) |
 | `make webhook` | Build `cmd/webhook` (deploy-webhook receiver) |
 | `make tidy` | `go mod tidy` |