feat: Phase 1 — extract the client (web SPA + desktop) to dtoro/oikos-web

Problem: the hexagonal refactor churns the backend tree for nine more
phases; the UI delivery stack (web/ SPA, cmd/desktop Wails wrapper,
compose/web image) must move to its own repo first so doc/layout
rewrites land once on a backend-only tree.

Change:
- New repo git.hubris.network/dtoro/oikos-web (v0.33.0): web/, desktop/
  (updateURL repointed to oikos-web releases), compose/, own CI (web +
  desktop jobs), own deploy script (CI-green gate, TOCTOU guard,
  version-tagged images, prune-to-3), own webhook receiver on :9798 +
  launchd unit, own compose project publishing the same 8091:80.
- Cutover executed on mac-mini in order: oikos stack's web service
  stopped+removed, oikos-web project brought up on 8091; outer Caddy
  untouched (targets the published port) — serving + Authentik flow +
  /wails 404 quirk verified post-cutover.
- Stripped from oikos: web/, cmd/desktop/, compose/web/, desktop CI
  workflow, ci.yml web job, Makefile ui/desktop/desktop-package/install
  targets, the compose web service, oikos-web from deploy.sh's fallback
  prune list; wails + go-keyring dropped from go.mod, vendor synced.
- README / CONTRIBUTING / AGENTS.md / .agents dev+operations docs now
  point at the new repo; mbse + mascot design docs carry a path note.

Risk: production SPA serving depends on the new pipeline now; rollback
is versioned-image re-up of the old web service from a pre-split
checkout (port 8091). Desktop builds installed before the split still
check dtoro/oikos releases — one manual reinstall, noted in the
oikos-web release notes.

Verification: go vet, make test (race), make generate-check, golangci
(no new findings; baseline down 400→365); post-cutover curls —
localhost:8091 200, /wails/runtime.js 404, outer Caddy 302 Authentik.

web/node_modules/@vitest/spy/dist/index.js

@@ -0,0 +1,145 @@
+import * as tinyspy from 'tinyspy';
+
+const mocks = /* @__PURE__ */ new Set();
+function isMockFunction(fn2) {
+  return typeof fn2 === "function" && "_isMockFunction" in fn2 && fn2._isMockFunction;
+}
+function spyOn(obj, method, accessType) {
+  const dictionary = {
+    get: "getter",
+    set: "setter"
+  };
+  const objMethod = accessType ? { [dictionary[accessType]]: method } : method;
+  const stub = tinyspy.internalSpyOn(obj, objMethod);
+  return enhanceSpy(stub);
+}
+let callOrder = 0;
+function enhanceSpy(spy) {
+  const stub = spy;
+  let implementation;
+  let instances = [];
+  let contexts = [];
+  let invocations = [];
+  const state = tinyspy.getInternalState(spy);
+  const mockContext = {
+    get calls() {
+      return state.calls;
+    },
+    get contexts() {
+      return contexts;
+    },
+    get instances() {
+      return instances;
+    },
+    get invocationCallOrder() {
+      return invocations;
+    },
+    get results() {
+      return state.results.map(([callType, value]) => {
+        const type = callType === "error" ? "throw" : "return";
+        return { type, value };
+      });
+    },
+    get settledResults() {
+      return state.resolves.map(([callType, value]) => {
+        const type = callType === "error" ? "rejected" : "fulfilled";
+        return { type, value };
+      });
+    },
+    get lastCall() {
+      return state.calls[state.calls.length - 1];
+    }
+  };
+  let onceImplementations = [];
+  let implementationChangedTemporarily = false;
+  function mockCall(...args) {
+    instances.push(this);
+    contexts.push(this);
+    invocations.push(++callOrder);
+    const impl = implementationChangedTemporarily ? implementation : onceImplementations.shift() || implementation || state.getOriginal() || (() => {
+    });
+    return impl.apply(this, args);
+  }
+  let name = stub.name;
+  stub.getMockName = () => name || "vi.fn()";
+  stub.mockName = (n) => {
+    name = n;
+    return stub;
+  };
+  stub.mockClear = () => {
+    state.reset();
+    instances = [];
+    contexts = [];
+    invocations = [];
+    return stub;
+  };
+  stub.mockReset = () => {
+    stub.mockClear();
+    implementation = () => void 0;
+    onceImplementations = [];
+    return stub;
+  };
+  stub.mockRestore = () => {
+    stub.mockReset();
+    state.restore();
+    implementation = void 0;
+    return stub;
+  };
+  stub.getMockImplementation = () => implementation;
+  stub.mockImplementation = (fn2) => {
+    implementation = fn2;
+    state.willCall(mockCall);
+    return stub;
+  };
+  stub.mockImplementationOnce = (fn2) => {
+    onceImplementations.push(fn2);
+    return stub;
+  };
+  function withImplementation(fn2, cb) {
+    const originalImplementation = implementation;
+    implementation = fn2;
+    state.willCall(mockCall);
+    implementationChangedTemporarily = true;
+    const reset = () => {
+      implementation = originalImplementation;
+      implementationChangedTemporarily = false;
+    };
+    const result = cb();
+    if (result instanceof Promise) {
+      return result.then(() => {
+        reset();
+        return stub;
+      });
+    }
+    reset();
+    return stub;
+  }
+  stub.withImplementation = withImplementation;
+  stub.mockReturnThis = () => stub.mockImplementation(function() {
+    return this;
+  });
+  stub.mockReturnValue = (val) => stub.mockImplementation(() => val);
+  stub.mockReturnValueOnce = (val) => stub.mockImplementationOnce(() => val);
+  stub.mockResolvedValue = (val) => stub.mockImplementation(() => Promise.resolve(val));
+  stub.mockResolvedValueOnce = (val) => stub.mockImplementationOnce(() => Promise.resolve(val));
+  stub.mockRejectedValue = (val) => stub.mockImplementation(() => Promise.reject(val));
+  stub.mockRejectedValueOnce = (val) => stub.mockImplementationOnce(() => Promise.reject(val));
+  Object.defineProperty(stub, "mock", {
+    get: () => mockContext
+  });
+  state.willCall(mockCall);
+  mocks.add(stub);
+  return stub;
+}
+function fn(implementation) {
+  const enhancedSpy = enhanceSpy(tinyspy.internalSpyOn({
+    spy: implementation || function() {
+    }
+  }, "spy"));
+  if (implementation) {
+    enhancedSpy.mockImplementation(implementation);
+  }
+  return enhancedSpy;
+}
+
+export { fn, isMockFunction, mocks, spyOn };