feat: Phase 1 — extract the client (web SPA + desktop) to dtoro/oikos-web

Problem: the hexagonal refactor churns the backend tree for nine more
phases; the UI delivery stack (web/ SPA, cmd/desktop Wails wrapper,
compose/web image) must move to its own repo first so doc/layout
rewrites land once on a backend-only tree.

Change:
- New repo git.hubris.network/dtoro/oikos-web (v0.33.0): web/, desktop/
  (updateURL repointed to oikos-web releases), compose/, own CI (web +
  desktop jobs), own deploy script (CI-green gate, TOCTOU guard,
  version-tagged images, prune-to-3), own webhook receiver on :9798 +
  launchd unit, own compose project publishing the same 8091:80.
- Cutover executed on mac-mini in order: oikos stack's web service
  stopped+removed, oikos-web project brought up on 8091; outer Caddy
  untouched (targets the published port) — serving + Authentik flow +
  /wails 404 quirk verified post-cutover.
- Stripped from oikos: web/, cmd/desktop/, compose/web/, desktop CI
  workflow, ci.yml web job, Makefile ui/desktop/desktop-package/install
  targets, the compose web service, oikos-web from deploy.sh's fallback
  prune list; wails + go-keyring dropped from go.mod, vendor synced.
- README / CONTRIBUTING / AGENTS.md / .agents dev+operations docs now
  point at the new repo; mbse + mascot design docs carry a path note.

Risk: production SPA serving depends on the new pipeline now; rollback
is versioned-image re-up of the old web service from a pre-split
checkout (port 8091). Desktop builds installed before the split still
check dtoro/oikos releases — one manual reinstall, noted in the
oikos-web release notes.

Verification: go vet, make test (race), make generate-check, golangci
(no new findings; baseline down 400→365); post-cutover curls —
localhost:8091 200, /wails/runtime.js 404, outer Caddy 302 Authentik.

web/node_modules/@vitest/snapshot/dist/index.d.ts

@@ -0,0 +1,110 @@
+import { S as SnapshotStateOptions, a as SnapshotMatchOptions, b as SnapshotResult, R as RawSnapshotInfo } from './rawSnapshot-CPNkto81.js';
+export { c as SnapshotData, d as SnapshotSerializer, e as SnapshotSummary, f as SnapshotUpdateState, U as UncheckedSnapshot } from './rawSnapshot-CPNkto81.js';
+import { S as SnapshotEnvironment } from './environment-Ddx0EDtY.js';
+import { Plugin, Plugins } from '@vitest/pretty-format';
+
+interface ParsedStack {
+    method: string;
+    file: string;
+    line: number;
+    column: number;
+}
+
+/**
+ * Copyright (c) Facebook, Inc. and its affiliates. All Rights Reserved.
+ *
+ * This source code is licensed under the MIT license found in the
+ * LICENSE file in the root directory of this source tree.
+ */
+
+interface SnapshotReturnOptions {
+    actual: string;
+    count: number;
+    expected?: string;
+    key: string;
+    pass: boolean;
+}
+interface SaveStatus {
+    deleted: boolean;
+    saved: boolean;
+}
+declare class SnapshotState {
+    testFilePath: string;
+    snapshotPath: string;
+    private _counters;
+    private _dirty;
+    private _updateSnapshot;
+    private _snapshotData;
+    private _initialData;
+    private _inlineSnapshots;
+    private _inlineSnapshotStacks;
+    private _rawSnapshots;
+    private _uncheckedKeys;
+    private _snapshotFormat;
+    private _environment;
+    private _fileExists;
+    added: number;
+    expand: boolean;
+    matched: number;
+    unmatched: number;
+    updated: number;
+    private constructor();
+    static create(testFilePath: string, options: SnapshotStateOptions): Promise<SnapshotState>;
+    get environment(): SnapshotEnvironment;
+    markSnapshotsAsCheckedForTest(testName: string): void;
+    protected _inferInlineSnapshotStack(stacks: ParsedStack[]): ParsedStack | null;
+    private _addSnapshot;
+    clear(): void;
+    save(): Promise<SaveStatus>;
+    getUncheckedCount(): number;
+    getUncheckedKeys(): Array<string>;
+    removeUncheckedKeys(): void;
+    match({ testName, received, key, inlineSnapshot, isInline, error, rawSnapshot, }: SnapshotMatchOptions): SnapshotReturnOptions;
+    pack(): Promise<SnapshotResult>;
+}
+
+interface AssertOptions {
+    received: unknown;
+    filepath?: string;
+    name?: string;
+    message?: string;
+    isInline?: boolean;
+    properties?: object;
+    inlineSnapshot?: string;
+    error?: Error;
+    errorMessage?: string;
+    rawSnapshot?: RawSnapshotInfo;
+}
+interface SnapshotClientOptions {
+    isEqual?: (received: unknown, expected: unknown) => boolean;
+}
+declare class SnapshotClient {
+    private options;
+    filepath?: string;
+    name?: string;
+    snapshotState: SnapshotState | undefined;
+    snapshotStateMap: Map<string, SnapshotState>;
+    constructor(options?: SnapshotClientOptions);
+    startCurrentRun(filepath: string, name: string, options: SnapshotStateOptions): Promise<void>;
+    getSnapshotState(filepath: string): SnapshotState;
+    clearTest(): void;
+    skipTestSnapshots(name: string): void;
+    assert(options: AssertOptions): void;
+    assertRaw(options: AssertOptions): Promise<void>;
+    finishCurrentRun(): Promise<SnapshotResult | null>;
+    clear(): void;
+}
+
+declare function stripSnapshotIndentation(inlineSnapshot: string): string;
+
+/**
+ * Copyright (c) Facebook, Inc. and its affiliates. All Rights Reserved.
+ *
+ * This source code is licensed under the MIT license found in the
+ * LICENSE file in the root directory of this source tree.
+ */
+
+declare function addSerializer(plugin: Plugin): void;
+declare function getSerializers(): Plugins;
+
+export { SnapshotClient, SnapshotMatchOptions, SnapshotResult, SnapshotState, SnapshotStateOptions, addSerializer, getSerializers, stripSnapshotIndentation };