feat: Phase 1 — extract the client (web SPA + desktop) to dtoro/oikos-web

Problem: the hexagonal refactor churns the backend tree for nine more
phases; the UI delivery stack (web/ SPA, cmd/desktop Wails wrapper,
compose/web image) must move to its own repo first so doc/layout
rewrites land once on a backend-only tree.

Change:
- New repo git.hubris.network/dtoro/oikos-web (v0.33.0): web/, desktop/
  (updateURL repointed to oikos-web releases), compose/, own CI (web +
  desktop jobs), own deploy script (CI-green gate, TOCTOU guard,
  version-tagged images, prune-to-3), own webhook receiver on :9798 +
  launchd unit, own compose project publishing the same 8091:80.
- Cutover executed on mac-mini in order: oikos stack's web service
  stopped+removed, oikos-web project brought up on 8091; outer Caddy
  untouched (targets the published port) — serving + Authentik flow +
  /wails 404 quirk verified post-cutover.
- Stripped from oikos: web/, cmd/desktop/, compose/web/, desktop CI
  workflow, ci.yml web job, Makefile ui/desktop/desktop-package/install
  targets, the compose web service, oikos-web from deploy.sh's fallback
  prune list; wails + go-keyring dropped from go.mod, vendor synced.
- README / CONTRIBUTING / AGENTS.md / .agents dev+operations docs now
  point at the new repo; mbse + mascot design docs carry a path note.

Risk: production SPA serving depends on the new pipeline now; rollback
is versioned-image re-up of the old web service from a pre-split
checkout (port 8091). Desktop builds installed before the split still
check dtoro/oikos releases — one manual reinstall, noted in the
oikos-web release notes.

Verification: go vet, make test (race), make generate-check, golangci
(no new findings; baseline down 400→365); post-cutover curls —
localhost:8091 200, /wails/runtime.js 404, outer Caddy 302 Authentik.

web/node_modules/@jridgewell/gen-mapping/dist/gen-mapping.mjs

@@ -0,0 +1,292 @@
+// src/set-array.ts
+var SetArray = class {
+  constructor() {
+    this._indexes = { __proto__: null };
+    this.array = [];
+  }
+};
+function cast(set) {
+  return set;
+}
+function get(setarr, key) {
+  return cast(setarr)._indexes[key];
+}
+function put(setarr, key) {
+  const index = get(setarr, key);
+  if (index !== void 0) return index;
+  const { array, _indexes: indexes } = cast(setarr);
+  const length = array.push(key);
+  return indexes[key] = length - 1;
+}
+function remove(setarr, key) {
+  const index = get(setarr, key);
+  if (index === void 0) return;
+  const { array, _indexes: indexes } = cast(setarr);
+  for (let i = index + 1; i < array.length; i++) {
+    const k = array[i];
+    array[i - 1] = k;
+    indexes[k]--;
+  }
+  indexes[key] = void 0;
+  array.pop();
+}
+
+// src/gen-mapping.ts
+import {
+  encode
+} from "@jridgewell/sourcemap-codec";
+import { TraceMap, decodedMappings } from "@jridgewell/trace-mapping";
+
+// src/sourcemap-segment.ts
+var COLUMN = 0;
+var SOURCES_INDEX = 1;
+var SOURCE_LINE = 2;
+var SOURCE_COLUMN = 3;
+var NAMES_INDEX = 4;
+
+// src/gen-mapping.ts
+var NO_NAME = -1;
+var GenMapping = class {
+  constructor({ file, sourceRoot } = {}) {
+    this._names = new SetArray();
+    this._sources = new SetArray();
+    this._sourcesContent = [];
+    this._mappings = [];
+    this.file = file;
+    this.sourceRoot = sourceRoot;
+    this._ignoreList = new SetArray();
+  }
+};
+function cast2(map) {
+  return map;
+}
+function addSegment(map, genLine, genColumn, source, sourceLine, sourceColumn, name, content) {
+  return addSegmentInternal(
+    false,
+    map,
+    genLine,
+    genColumn,
+    source,
+    sourceLine,
+    sourceColumn,
+    name,
+    content
+  );
+}
+function addMapping(map, mapping) {
+  return addMappingInternal(false, map, mapping);
+}
+var maybeAddSegment = (map, genLine, genColumn, source, sourceLine, sourceColumn, name, content) => {
+  return addSegmentInternal(
+    true,
+    map,
+    genLine,
+    genColumn,
+    source,
+    sourceLine,
+    sourceColumn,
+    name,
+    content
+  );
+};
+var maybeAddMapping = (map, mapping) => {
+  return addMappingInternal(true, map, mapping);
+};
+function setSourceContent(map, source, content) {
+  const {
+    _sources: sources,
+    _sourcesContent: sourcesContent
+    // _originalScopes: originalScopes,
+  } = cast2(map);
+  const index = put(sources, source);
+  sourcesContent[index] = content;
+}
+function setIgnore(map, source, ignore = true) {
+  const {
+    _sources: sources,
+    _sourcesContent: sourcesContent,
+    _ignoreList: ignoreList
+    // _originalScopes: originalScopes,
+  } = cast2(map);
+  const index = put(sources, source);
+  if (index === sourcesContent.length) sourcesContent[index] = null;
+  if (ignore) put(ignoreList, index);
+  else remove(ignoreList, index);
+}
+function toDecodedMap(map) {
+  const {
+    _mappings: mappings,
+    _sources: sources,
+    _sourcesContent: sourcesContent,
+    _names: names,
+    _ignoreList: ignoreList
+    // _originalScopes: originalScopes,
+    // _generatedRanges: generatedRanges,
+  } = cast2(map);
+  removeEmptyFinalLines(mappings);
+  return {
+    version: 3,
+    file: map.file || void 0,
+    names: names.array,
+    sourceRoot: map.sourceRoot || void 0,
+    sources: sources.array,
+    sourcesContent,
+    mappings,
+    // originalScopes,
+    // generatedRanges,
+    ignoreList: ignoreList.array
+  };
+}
+function toEncodedMap(map) {
+  const decoded = toDecodedMap(map);
+  return Object.assign({}, decoded, {
+    // originalScopes: decoded.originalScopes.map((os) => encodeOriginalScopes(os)),
+    // generatedRanges: encodeGeneratedRanges(decoded.generatedRanges as GeneratedRange[]),
+    mappings: encode(decoded.mappings)
+  });
+}
+function fromMap(input) {
+  const map = new TraceMap(input);
+  const gen = new GenMapping({ file: map.file, sourceRoot: map.sourceRoot });
+  putAll(cast2(gen)._names, map.names);
+  putAll(cast2(gen)._sources, map.sources);
+  cast2(gen)._sourcesContent = map.sourcesContent || map.sources.map(() => null);
+  cast2(gen)._mappings = decodedMappings(map);
+  if (map.ignoreList) putAll(cast2(gen)._ignoreList, map.ignoreList);
+  return gen;
+}
+function allMappings(map) {
+  const out = [];
+  const { _mappings: mappings, _sources: sources, _names: names } = cast2(map);
+  for (let i = 0; i < mappings.length; i++) {
+    const line = mappings[i];
+    for (let j = 0; j < line.length; j++) {
+      const seg = line[j];
+      const generated = { line: i + 1, column: seg[COLUMN] };
+      let source = void 0;
+      let original = void 0;
+      let name = void 0;
+      if (seg.length !== 1) {
+        source = sources.array[seg[SOURCES_INDEX]];
+        original = { line: seg[SOURCE_LINE] + 1, column: seg[SOURCE_COLUMN] };
+        if (seg.length === 5) name = names.array[seg[NAMES_INDEX]];
+      }
+      out.push({ generated, source, original, name });
+    }
+  }
+  return out;
+}
+function addSegmentInternal(skipable, map, genLine, genColumn, source, sourceLine, sourceColumn, name, content) {
+  const {
+    _mappings: mappings,
+    _sources: sources,
+    _sourcesContent: sourcesContent,
+    _names: names
+    // _originalScopes: originalScopes,
+  } = cast2(map);
+  const line = getIndex(mappings, genLine);
+  const index = getColumnIndex(line, genColumn);
+  if (!source) {
+    if (skipable && skipSourceless(line, index)) return;
+    return insert(line, index, [genColumn]);
+  }
+  assert(sourceLine);
+  assert(sourceColumn);
+  const sourcesIndex = put(sources, source);
+  const namesIndex = name ? put(names, name) : NO_NAME;
+  if (sourcesIndex === sourcesContent.length) sourcesContent[sourcesIndex] = content != null ? content : null;
+  if (skipable && skipSource(line, index, sourcesIndex, sourceLine, sourceColumn, namesIndex)) {
+    return;
+  }
+  return insert(
+    line,
+    index,
+    name ? [genColumn, sourcesIndex, sourceLine, sourceColumn, namesIndex] : [genColumn, sourcesIndex, sourceLine, sourceColumn]
+  );
+}
+function assert(_val) {
+}
+function getIndex(arr, index) {
+  for (let i = arr.length; i <= index; i++) {
+    arr[i] = [];
+  }
+  return arr[index];
+}
+function getColumnIndex(line, genColumn) {
+  let index = line.length;
+  for (let i = index - 1; i >= 0; index = i--) {
+    const current = line[i];
+    if (genColumn >= current[COLUMN]) break;
+  }
+  return index;
+}
+function insert(array, index, value) {
+  for (let i = array.length; i > index; i--) {
+    array[i] = array[i - 1];
+  }
+  array[index] = value;
+}
+function removeEmptyFinalLines(mappings) {
+  const { length } = mappings;
+  let len = length;
+  for (let i = len - 1; i >= 0; len = i, i--) {
+    if (mappings[i].length > 0) break;
+  }
+  if (len < length) mappings.length = len;
+}
+function putAll(setarr, array) {
+  for (let i = 0; i < array.length; i++) put(setarr, array[i]);
+}
+function skipSourceless(line, index) {
+  if (index === 0) return true;
+  const prev = line[index - 1];
+  return prev.length === 1;
+}
+function skipSource(line, index, sourcesIndex, sourceLine, sourceColumn, namesIndex) {
+  if (index === 0) return false;
+  const prev = line[index - 1];
+  if (prev.length === 1) return false;
+  return sourcesIndex === prev[SOURCES_INDEX] && sourceLine === prev[SOURCE_LINE] && sourceColumn === prev[SOURCE_COLUMN] && namesIndex === (prev.length === 5 ? prev[NAMES_INDEX] : NO_NAME);
+}
+function addMappingInternal(skipable, map, mapping) {
+  const { generated, source, original, name, content } = mapping;
+  if (!source) {
+    return addSegmentInternal(
+      skipable,
+      map,
+      generated.line - 1,
+      generated.column,
+      null,
+      null,
+      null,
+      null,
+      null
+    );
+  }
+  assert(original);
+  return addSegmentInternal(
+    skipable,
+    map,
+    generated.line - 1,
+    generated.column,
+    source,
+    original.line - 1,
+    original.column,
+    name,
+    content
+  );
+}
+export {
+  GenMapping,
+  addMapping,
+  addSegment,
+  allMappings,
+  fromMap,
+  maybeAddMapping,
+  maybeAddSegment,
+  setIgnore,
+  setSourceContent,
+  toDecodedMap,
+  toEncodedMap
+};
+//# sourceMappingURL=gen-mapping.mjs.map