feat: Phase 1 — extract the client (web SPA + desktop) to dtoro/oikos-web

Problem: the hexagonal refactor churns the backend tree for nine more
phases; the UI delivery stack (web/ SPA, cmd/desktop Wails wrapper,
compose/web image) must move to its own repo first so doc/layout
rewrites land once on a backend-only tree.

Change:
- New repo git.hubris.network/dtoro/oikos-web (v0.33.0): web/, desktop/
  (updateURL repointed to oikos-web releases), compose/, own CI (web +
  desktop jobs), own deploy script (CI-green gate, TOCTOU guard,
  version-tagged images, prune-to-3), own webhook receiver on :9798 +
  launchd unit, own compose project publishing the same 8091:80.
- Cutover executed on mac-mini in order: oikos stack's web service
  stopped+removed, oikos-web project brought up on 8091; outer Caddy
  untouched (targets the published port) — serving + Authentik flow +
  /wails 404 quirk verified post-cutover.
- Stripped from oikos: web/, cmd/desktop/, compose/web/, desktop CI
  workflow, ci.yml web job, Makefile ui/desktop/desktop-package/install
  targets, the compose web service, oikos-web from deploy.sh's fallback
  prune list; wails + go-keyring dropped from go.mod, vendor synced.
- README / CONTRIBUTING / AGENTS.md / .agents dev+operations docs now
  point at the new repo; mbse + mascot design docs carry a path note.

Risk: production SPA serving depends on the new pipeline now; rollback
is versioned-image re-up of the old web service from a pre-split
checkout (port 8091). Desktop builds installed before the split still
check dtoro/oikos releases — one manual reinstall, noted in the
oikos-web release notes.

Verification: go vet, make test (race), make generate-check, golangci
(no new findings; baseline down 400→365); post-cutover curls —
localhost:8091 200, /wails/runtime.js 404, outer Caddy 302 Authentik.

web/node_modules/@vitest/snapshot/README.md

@@ -0,0 +1,84 @@
+# @vitest/snapshot
+
+Lightweight implementation of Jest's snapshots.
+
+## Usage
+
+```js
+import { SnapshotClient } from '@vitest/snapshot'
+import { NodeSnapshotEnvironment } from '@vitest/snapshot/environment'
+import { SnapshotManager } from '@vitest/snapshot/manager'
+
+const client = new SnapshotClient({
+  // you need to provide your own equality check implementation if you use it
+  // this function is called when `.toMatchSnapshot({ property: 1 })` is called
+  isEqual: (received, expected) =>
+    equals(received, expected, [iterableEquality, subsetEquality]),
+})
+
+// class that implements snapshot saving and reading
+// by default uses fs module, but you can provide your own implementation depending on the environment
+const environment = new NodeSnapshotEnvironment()
+
+// you need to implement this yourselves,
+// this depends on your runner
+function getCurrentFilepath() {
+  return '/file.spec.js'
+}
+function getCurrentTestName() {
+  return 'test1'
+}
+
+// example for inline snapshots, nothing is required to support regular snapshots,
+// just call `assert` with `isInline: false`
+function wrapper(received) {
+  function __INLINE_SNAPSHOT__(inlineSnapshot, message) {
+    client.assert({
+      received,
+      message,
+      isInline: true,
+      inlineSnapshot,
+      filepath: getCurrentFilepath(),
+      name: getCurrentTestName(),
+    })
+  }
+  return {
+    // the name is hard-coded, it should be inside another function, so Vitest can find the actual test file where it was called (parses call stack trace + 2)
+    // you can override this behaviour in SnapshotState's `_inferInlineSnapshotStack` method by providing your own SnapshotState to SnapshotClient constructor
+    toMatchInlineSnapshot: (...args) => __INLINE_SNAPSHOT__(...args),
+  }
+}
+
+const options = {
+  updateSnapshot: 'new',
+  snapshotEnvironment: environment,
+}
+
+await client.startCurrentRun(
+  getCurrentFilepath(),
+  getCurrentTestName(),
+  options
+)
+
+// this will save snapshot to a file which is returned by "snapshotEnvironment.resolvePath"
+client.assert({
+  received: 'some text',
+  isInline: false,
+})
+
+// uses "pretty-format", so it requires quotes
+// also naming is hard-coded when parsing test files
+wrapper('text 1').toMatchInlineSnapshot()
+wrapper('text 2').toMatchInlineSnapshot('"text 2"')
+
+const result = await client.finishCurrentRun() // this saves files and returns SnapshotResult
+
+// you can use manager to manage several clients
+const manager = new SnapshotManager(options)
+manager.add(result)
+
+// do something
+// and then read the summary
+
+console.log(manager.summary)
+```