feat: Phase 1 — extract the client (web SPA + desktop) to dtoro/oikos-web

Problem: the hexagonal refactor churns the backend tree for nine more
phases; the UI delivery stack (web/ SPA, cmd/desktop Wails wrapper,
compose/web image) must move to its own repo first so doc/layout
rewrites land once on a backend-only tree.

Change:
- New repo git.hubris.network/dtoro/oikos-web (v0.33.0): web/, desktop/
  (updateURL repointed to oikos-web releases), compose/, own CI (web +
  desktop jobs), own deploy script (CI-green gate, TOCTOU guard,
  version-tagged images, prune-to-3), own webhook receiver on :9798 +
  launchd unit, own compose project publishing the same 8091:80.
- Cutover executed on mac-mini in order: oikos stack's web service
  stopped+removed, oikos-web project brought up on 8091; outer Caddy
  untouched (targets the published port) — serving + Authentik flow +
  /wails 404 quirk verified post-cutover.
- Stripped from oikos: web/, cmd/desktop/, compose/web/, desktop CI
  workflow, ci.yml web job, Makefile ui/desktop/desktop-package/install
  targets, the compose web service, oikos-web from deploy.sh's fallback
  prune list; wails + go-keyring dropped from go.mod, vendor synced.
- README / CONTRIBUTING / AGENTS.md / .agents dev+operations docs now
  point at the new repo; mbse + mascot design docs carry a path note.

Risk: production SPA serving depends on the new pipeline now; rollback
is versioned-image re-up of the old web service from a pre-split
checkout (port 8091). Desktop builds installed before the split still
check dtoro/oikos releases — one manual reinstall, noted in the
oikos-web release notes.

Verification: go vet, make test (race), make generate-check, golangci
(no new findings; baseline down 400→365); post-cutover curls —
localhost:8091 200, /wails/runtime.js 404, outer Caddy 302 Authentik.

web/node_modules/@vitest/utils/dist/error.js

@@ -0,0 +1,137 @@
+import { printDiffOrStringify } from './diff.js';
+import { f as format, s as stringify } from './chunk-_commonjsHelpers.js';
+import '@vitest/pretty-format';
+import 'tinyrainbow';
+import './helpers.js';
+import 'loupe';
+
+const IS_RECORD_SYMBOL = "@@__IMMUTABLE_RECORD__@@";
+const IS_COLLECTION_SYMBOL = "@@__IMMUTABLE_ITERABLE__@@";
+function isImmutable(v) {
+  return v && (v[IS_COLLECTION_SYMBOL] || v[IS_RECORD_SYMBOL]);
+}
+const OBJECT_PROTO = Object.getPrototypeOf({});
+function getUnserializableMessage(err) {
+  if (err instanceof Error) {
+    return `<unserializable>: ${err.message}`;
+  }
+  if (typeof err === "string") {
+    return `<unserializable>: ${err}`;
+  }
+  return "<unserializable>";
+}
+function serializeValue(val, seen = /* @__PURE__ */ new WeakMap()) {
+  if (!val || typeof val === "string") {
+    return val;
+  }
+  if (typeof val === "function") {
+    return `Function<${val.name || "anonymous"}>`;
+  }
+  if (typeof val === "symbol") {
+    return val.toString();
+  }
+  if (typeof val !== "object") {
+    return val;
+  }
+  if (isImmutable(val)) {
+    return serializeValue(val.toJSON(), seen);
+  }
+  if (val instanceof Promise || val.constructor && val.constructor.prototype === "AsyncFunction") {
+    return "Promise";
+  }
+  if (typeof Element !== "undefined" && val instanceof Element) {
+    return val.tagName;
+  }
+  if (typeof val.asymmetricMatch === "function") {
+    return `${val.toString()} ${format(val.sample)}`;
+  }
+  if (typeof val.toJSON === "function") {
+    return serializeValue(val.toJSON(), seen);
+  }
+  if (seen.has(val)) {
+    return seen.get(val);
+  }
+  if (Array.isArray(val)) {
+    const clone = new Array(val.length);
+    seen.set(val, clone);
+    val.forEach((e, i) => {
+      try {
+        clone[i] = serializeValue(e, seen);
+      } catch (err) {
+        clone[i] = getUnserializableMessage(err);
+      }
+    });
+    return clone;
+  } else {
+    const clone = /* @__PURE__ */ Object.create(null);
+    seen.set(val, clone);
+    let obj = val;
+    while (obj && obj !== OBJECT_PROTO) {
+      Object.getOwnPropertyNames(obj).forEach((key) => {
+        if (key in clone) {
+          return;
+        }
+        try {
+          clone[key] = serializeValue(val[key], seen);
+        } catch (err) {
+          delete clone[key];
+          clone[key] = getUnserializableMessage(err);
+        }
+      });
+      obj = Object.getPrototypeOf(obj);
+    }
+    return clone;
+  }
+}
+function normalizeErrorMessage(message) {
+  return message.replace(/__(vite_ssr_import|vi_import)_\d+__\./g, "");
+}
+function processError(_err, diffOptions, seen = /* @__PURE__ */ new WeakSet()) {
+  if (!_err || typeof _err !== "object") {
+    return { message: String(_err) };
+  }
+  const err = _err;
+  if (err.stack) {
+    err.stackStr = String(err.stack);
+  }
+  if (err.name) {
+    err.nameStr = String(err.name);
+  }
+  if (err.showDiff || err.showDiff === void 0 && err.expected !== void 0 && err.actual !== void 0) {
+    err.diff = printDiffOrStringify(err.actual, err.expected, {
+      ...diffOptions,
+      ...err.diffOptions
+    });
+  }
+  if (typeof err.expected !== "string") {
+    err.expected = stringify(err.expected, 10);
+  }
+  if (typeof err.actual !== "string") {
+    err.actual = stringify(err.actual, 10);
+  }
+  try {
+    if (typeof err.message === "string") {
+      err.message = normalizeErrorMessage(err.message);
+    }
+  } catch {
+  }
+  try {
+    if (!seen.has(err) && typeof err.cause === "object") {
+      seen.add(err);
+      err.cause = processError(err.cause, diffOptions, seen);
+    }
+  } catch {
+  }
+  try {
+    return serializeValue(err);
+  } catch (e) {
+    return serializeValue(
+      new Error(
+        `Failed to fully serialize error: ${e == null ? void 0 : e.message}
+Inner error message: ${err == null ? void 0 : err.message}`
+      )
+    );
+  }
+}
+
+export { processError, serializeValue as serializeError, serializeValue };