feat: Phase 1 — extract the client (web SPA + desktop) to dtoro/oikos-web

Problem: the hexagonal refactor churns the backend tree for nine more
phases; the UI delivery stack (web/ SPA, cmd/desktop Wails wrapper,
compose/web image) must move to its own repo first so doc/layout
rewrites land once on a backend-only tree.

Change:
- New repo git.hubris.network/dtoro/oikos-web (v0.33.0): web/, desktop/
  (updateURL repointed to oikos-web releases), compose/, own CI (web +
  desktop jobs), own deploy script (CI-green gate, TOCTOU guard,
  version-tagged images, prune-to-3), own webhook receiver on :9798 +
  launchd unit, own compose project publishing the same 8091:80.
- Cutover executed on mac-mini in order: oikos stack's web service
  stopped+removed, oikos-web project brought up on 8091; outer Caddy
  untouched (targets the published port) — serving + Authentik flow +
  /wails 404 quirk verified post-cutover.
- Stripped from oikos: web/, cmd/desktop/, compose/web/, desktop CI
  workflow, ci.yml web job, Makefile ui/desktop/desktop-package/install
  targets, the compose web service, oikos-web from deploy.sh's fallback
  prune list; wails + go-keyring dropped from go.mod, vendor synced.
- README / CONTRIBUTING / AGENTS.md / .agents dev+operations docs now
  point at the new repo; mbse + mascot design docs carry a path note.

Risk: production SPA serving depends on the new pipeline now; rollback
is versioned-image re-up of the old web service from a pre-split
checkout (port 8091). Desktop builds installed before the split still
check dtoro/oikos releases — one manual reinstall, noted in the
oikos-web release notes.

Verification: go vet, make test (race), make generate-check, golangci
(no new findings; baseline down 400→365); post-cutover curls —
localhost:8091 200, /wails/runtime.js 404, outer Caddy 302 Authentik.

web/node_modules/@eslint/eslintrc/lib/config-array/config-dependency.js

@@ -0,0 +1,124 @@
+/**
+ * @fileoverview `ConfigDependency` class.
+ *
+ * `ConfigDependency` class expresses a loaded parser or plugin.
+ *
+ * If the parser or plugin was loaded successfully, it has `definition` property
+ * and `filePath` property. Otherwise, it has `error` property.
+ *
+ * When `JSON.stringify()` converted a `ConfigDependency` object to a JSON, it
+ * omits `definition` property.
+ *
+ * `ConfigArrayFactory` creates `ConfigDependency` objects when it loads parsers
+ * or plugins.
+ *
+ * @author Toru Nagashima <https://github.com/mysticatea>
+ */
+
+import util from "node:util";
+
+/**
+ * The class is to store parsers or plugins.
+ * This class hides the loaded object from `JSON.stringify()` and `console.log`.
+ * @template T
+ */
+class ConfigDependency {
+
+    /**
+     * Initialize this instance.
+     * @param {Object} data The dependency data.
+     * @param {T} [data.definition] The dependency if the loading succeeded.
+     * @param {T} [data.original] The original, non-normalized dependency if the loading succeeded.
+     * @param {Error} [data.error] The error object if the loading failed.
+     * @param {string} [data.filePath] The actual path to the dependency if the loading succeeded.
+     * @param {string} data.id The ID of this dependency.
+     * @param {string} data.importerName The name of the config file which loads this dependency.
+     * @param {string} data.importerPath The path to the config file which loads this dependency.
+     */
+    constructor({
+        definition = null,
+        original = null,
+        error = null,
+        filePath = null,
+        id,
+        importerName,
+        importerPath
+    }) {
+
+        /**
+         * The loaded dependency if the loading succeeded.
+         * @type {T|null}
+         */
+        this.definition = definition;
+
+        /**
+         * The original dependency as loaded directly from disk if the loading succeeded.
+         * @type {T|null}
+         */
+        this.original = original;
+
+        /**
+         * The error object if the loading failed.
+         * @type {Error|null}
+         */
+        this.error = error;
+
+        /**
+         * The loaded dependency if the loading succeeded.
+         * @type {string|null}
+         */
+        this.filePath = filePath;
+
+        /**
+         * The ID of this dependency.
+         * @type {string}
+         */
+        this.id = id;
+
+        /**
+         * The name of the config file which loads this dependency.
+         * @type {string}
+         */
+        this.importerName = importerName;
+
+        /**
+         * The path to the config file which loads this dependency.
+         * @type {string}
+         */
+        this.importerPath = importerPath;
+    }
+
+    /**
+     * Converts this instance to a JSON compatible object.
+     * @returns {Object} a JSON compatible object.
+     */
+    toJSON() {
+        const obj = this[util.inspect.custom]();
+
+        // Display `error.message` (`Error#message` is unenumerable).
+        if (obj.error instanceof Error) {
+            obj.error = { ...obj.error, message: obj.error.message };
+        }
+
+        return obj;
+    }
+
+    /**
+     * Custom inspect method for Node.js `console.log()`.
+     * @returns {Object} an object to display by `console.log()`.
+     */
+    [util.inspect.custom]() {
+        const {
+            definition: _ignore1, // eslint-disable-line no-unused-vars -- needed to make `obj` correct
+            original: _ignore2, // eslint-disable-line no-unused-vars -- needed to make `obj` correct
+            ...obj
+        } = this;
+
+        return obj;
+    }
+}
+
+/** @typedef {ConfigDependency<import("../../shared/types").Parser>} DependentParser */
+/** @typedef {ConfigDependency<import("../../shared/types").Plugin>} DependentPlugin */
+
+export { ConfigDependency };