feat: Phase 1 — extract the client (web SPA + desktop) to dtoro/oikos-web

Problem: the hexagonal refactor churns the backend tree for nine more
phases; the UI delivery stack (web/ SPA, cmd/desktop Wails wrapper,
compose/web image) must move to its own repo first so doc/layout
rewrites land once on a backend-only tree.

Change:
- New repo git.hubris.network/dtoro/oikos-web (v0.33.0): web/, desktop/
  (updateURL repointed to oikos-web releases), compose/, own CI (web +
  desktop jobs), own deploy script (CI-green gate, TOCTOU guard,
  version-tagged images, prune-to-3), own webhook receiver on :9798 +
  launchd unit, own compose project publishing the same 8091:80.
- Cutover executed on mac-mini in order: oikos stack's web service
  stopped+removed, oikos-web project brought up on 8091; outer Caddy
  untouched (targets the published port) — serving + Authentik flow +
  /wails 404 quirk verified post-cutover.
- Stripped from oikos: web/, cmd/desktop/, compose/web/, desktop CI
  workflow, ci.yml web job, Makefile ui/desktop/desktop-package/install
  targets, the compose web service, oikos-web from deploy.sh's fallback
  prune list; wails + go-keyring dropped from go.mod, vendor synced.
- README / CONTRIBUTING / AGENTS.md / .agents dev+operations docs now
  point at the new repo; mbse + mascot design docs carry a path note.

Risk: production SPA serving depends on the new pipeline now; rollback
is versioned-image re-up of the old web service from a pre-split
checkout (port 8091). Desktop builds installed before the split still
check dtoro/oikos releases — one manual reinstall, noted in the
oikos-web release notes.

Verification: go vet, make test (race), make generate-check, golangci
(no new findings; baseline down 400→365); post-cutover curls —
localhost:8091 200, /wails/runtime.js 404, outer Caddy 302 Authentik.

README.md

@@ -29,8 +29,8 @@ OIKOS_DATABASE_URL="postgres://oikos:oikos_dev@localhost:5432/oikos?sslmode=disa
   OIKOS_API_TOKEN=dev-token \
   go run ./cmd/oikos all
 
-# Control-room SPA (separate from the Go binary — see web/)
-cd web && OIKOS_API_TOKEN=dev-token npm run dev   # http://localhost:5173
+# Control-room SPA + desktop app: own repo — dtoro/oikos-web
+# (~/Projects/oikos-web; cd web && OIKOS_API_TOKEN=dev-token npm run dev)
 ```
 
 ## Architecture
@@ -106,12 +106,14 @@ oikos secret migrate  # SOPS → Infisical
 
 ### Web UI
 
-`web/` is a standalone Svelte 5 SPA — not embedded in the `oikos` binary, not
-part of `docker-compose.yml`. It talks to `api`/`nomos` over HTTP with a
-bearer token entered on first launch (see `web/src/pages/Config.svelte`).
-Build with `make ui`, deploy with `make deploy-ui` (Caddy serves the static
-output). A native desktop wrapper exists at `cmd/desktop/` — see
-[plans/done/2026-07-12-wails-desktop-app.md](plans/done/2026-07-12-wails-desktop-app.md).
+The control-room SPA and the Wails desktop wrapper live in their own repo,
+[dtoro/oikos-web](https://git.hubris.network/dtoro/oikos-web) (local
+checkout `~/Projects/oikos-web`) — extracted in Phase 1 of
+[plans/2026-08-15-hexagonal-architecture.md](plans/2026-08-15-hexagonal-architecture.md).
+The SPA talks to `api`/`nomos` over HTTP with a bearer token entered on
+first launch. It deploys as its own compose project publishing `8091:80`;
+the outer Caddy (LXC 121) targets that published port, so serving and auth
+are unchanged from the pre-split stack.
 
 ## Repo layout
 
@@ -119,11 +121,9 @@ output). A native desktop wrapper exists at `cmd/desktop/` — see
 cmd/oikos/          Go entry point — single binary
 cmd/nomos/          Nomos MCP client gateway
 cmd/webhook/        Gitea deploy-webhook receiver (push-to-deploy on mac-mini)
-cmd/desktop/        Wails desktop wrapper around the SPA
-internal/           Go packages (actuator, checkdefaults, config, db, domain,
-                    httpapi, knowledge, learning, mcp, observability,
+internal/           Go packages (actuator, checkdefaults, config, core, db,
+                    domain, httpapi, knowledge, learning, mcp, observability,
                     ontology, policy, safego, scheduler, secrets)
-web/                Control-room SPA (Svelte 5) — standalone, not embedded
 api/openapi.yaml    API contract (OpenAPI 3.1)
 migrations/         Forward-only SQL migrations (TimescaleDB)
 seeds/              Bootstrap YAML (ontology, inventory, policy, knowledge)