feat: Phase 1 — extract the client (web SPA + desktop) to dtoro/oikos-web

Problem: the hexagonal refactor churns the backend tree for nine more
phases; the UI delivery stack (web/ SPA, cmd/desktop Wails wrapper,
compose/web image) must move to its own repo first so doc/layout
rewrites land once on a backend-only tree.

Change:
- New repo git.hubris.network/dtoro/oikos-web (v0.33.0): web/, desktop/
  (updateURL repointed to oikos-web releases), compose/, own CI (web +
  desktop jobs), own deploy script (CI-green gate, TOCTOU guard,
  version-tagged images, prune-to-3), own webhook receiver on :9798 +
  launchd unit, own compose project publishing the same 8091:80.
- Cutover executed on mac-mini in order: oikos stack's web service
  stopped+removed, oikos-web project brought up on 8091; outer Caddy
  untouched (targets the published port) — serving + Authentik flow +
  /wails 404 quirk verified post-cutover.
- Stripped from oikos: web/, cmd/desktop/, compose/web/, desktop CI
  workflow, ci.yml web job, Makefile ui/desktop/desktop-package/install
  targets, the compose web service, oikos-web from deploy.sh's fallback
  prune list; wails + go-keyring dropped from go.mod, vendor synced.
- README / CONTRIBUTING / AGENTS.md / .agents dev+operations docs now
  point at the new repo; mbse + mascot design docs carry a path note.

Risk: production SPA serving depends on the new pipeline now; rollback
is versioned-image re-up of the old web service from a pre-split
checkout (port 8091). Desktop builds installed before the split still
check dtoro/oikos releases — one manual reinstall, noted in the
oikos-web release notes.

Verification: go vet, make test (race), make generate-check, golangci
(no new findings; baseline down 400→365); post-cutover curls —
localhost:8091 200, /wails/runtime.js 404, outer Caddy 302 Authentik.

web/node_modules/@vitest/utils/dist/helpers.js

@@ -0,0 +1,224 @@
+function createSimpleStackTrace(options) {
+  const { message = "$$stack trace error", stackTraceLimit = 1 } = options || {};
+  const limit = Error.stackTraceLimit;
+  const prepareStackTrace = Error.prepareStackTrace;
+  Error.stackTraceLimit = stackTraceLimit;
+  Error.prepareStackTrace = (e) => e.stack;
+  const err = new Error(message);
+  const stackTrace = err.stack || "";
+  Error.prepareStackTrace = prepareStackTrace;
+  Error.stackTraceLimit = limit;
+  return stackTrace;
+}
+function notNullish(v) {
+  return v != null;
+}
+function assertTypes(value, name, types) {
+  const receivedType = typeof value;
+  const pass = types.includes(receivedType);
+  if (!pass) {
+    throw new TypeError(
+      `${name} value must be ${types.join(" or ")}, received "${receivedType}"`
+    );
+  }
+}
+function isPrimitive(value) {
+  return value === null || typeof value !== "function" && typeof value !== "object";
+}
+function slash(path) {
+  return path.replace(/\\/g, "/");
+}
+function parseRegexp(input) {
+  const m = input.match(/(\/?)(.+)\1([a-z]*)/i);
+  if (!m) {
+    return /$^/;
+  }
+  if (m[3] && !/^(?!.*?(.).*?\1)[gmixXsuUAJ]+$/.test(m[3])) {
+    return new RegExp(input);
+  }
+  return new RegExp(m[2], m[3]);
+}
+function toArray(array) {
+  if (array === null || array === void 0) {
+    array = [];
+  }
+  if (Array.isArray(array)) {
+    return array;
+  }
+  return [array];
+}
+function isObject(item) {
+  return item != null && typeof item === "object" && !Array.isArray(item);
+}
+function isFinalObj(obj) {
+  return obj === Object.prototype || obj === Function.prototype || obj === RegExp.prototype;
+}
+function getType(value) {
+  return Object.prototype.toString.apply(value).slice(8, -1);
+}
+function collectOwnProperties(obj, collector) {
+  const collect = typeof collector === "function" ? collector : (key) => collector.add(key);
+  Object.getOwnPropertyNames(obj).forEach(collect);
+  Object.getOwnPropertySymbols(obj).forEach(collect);
+}
+function getOwnProperties(obj) {
+  const ownProps = /* @__PURE__ */ new Set();
+  if (isFinalObj(obj)) {
+    return [];
+  }
+  collectOwnProperties(obj, ownProps);
+  return Array.from(ownProps);
+}
+const defaultCloneOptions = { forceWritable: false };
+function deepClone(val, options = defaultCloneOptions) {
+  const seen = /* @__PURE__ */ new WeakMap();
+  return clone(val, seen, options);
+}
+function clone(val, seen, options = defaultCloneOptions) {
+  let k, out;
+  if (seen.has(val)) {
+    return seen.get(val);
+  }
+  if (Array.isArray(val)) {
+    out = Array.from({ length: k = val.length });
+    seen.set(val, out);
+    while (k--) {
+      out[k] = clone(val[k], seen, options);
+    }
+    return out;
+  }
+  if (Object.prototype.toString.call(val) === "[object Object]") {
+    out = Object.create(Object.getPrototypeOf(val));
+    seen.set(val, out);
+    const props = getOwnProperties(val);
+    for (const k2 of props) {
+      const descriptor = Object.getOwnPropertyDescriptor(val, k2);
+      if (!descriptor) {
+        continue;
+      }
+      const cloned = clone(val[k2], seen, options);
+      if (options.forceWritable) {
+        Object.defineProperty(out, k2, {
+          enumerable: descriptor.enumerable,
+          configurable: true,
+          writable: true,
+          value: cloned
+        });
+      } else if ("get" in descriptor) {
+        Object.defineProperty(out, k2, {
+          ...descriptor,
+          get() {
+            return cloned;
+          }
+        });
+      } else {
+        Object.defineProperty(out, k2, {
+          ...descriptor,
+          value: cloned
+        });
+      }
+    }
+    return out;
+  }
+  return val;
+}
+function noop() {
+}
+function objectAttr(source, path, defaultValue = void 0) {
+  const paths = path.replace(/\[(\d+)\]/g, ".$1").split(".");
+  let result = source;
+  for (const p of paths) {
+    result = new Object(result)[p];
+    if (result === void 0) {
+      return defaultValue;
+    }
+  }
+  return result;
+}
+function createDefer() {
+  let resolve = null;
+  let reject = null;
+  const p = new Promise((_resolve, _reject) => {
+    resolve = _resolve;
+    reject = _reject;
+  });
+  p.resolve = resolve;
+  p.reject = reject;
+  return p;
+}
+function getCallLastIndex(code) {
+  let charIndex = -1;
+  let inString = null;
+  let startedBracers = 0;
+  let endedBracers = 0;
+  let beforeChar = null;
+  while (charIndex <= code.length) {
+    beforeChar = code[charIndex];
+    charIndex++;
+    const char = code[charIndex];
+    const isCharString = char === '"' || char === "'" || char === "`";
+    if (isCharString && beforeChar !== "\\") {
+      if (inString === char) {
+        inString = null;
+      } else if (!inString) {
+        inString = char;
+      }
+    }
+    if (!inString) {
+      if (char === "(") {
+        startedBracers++;
+      }
+      if (char === ")") {
+        endedBracers++;
+      }
+    }
+    if (startedBracers && endedBracers && startedBracers === endedBracers) {
+      return charIndex;
+    }
+  }
+  return null;
+}
+function isNegativeNaN(val) {
+  if (!Number.isNaN(val)) {
+    return false;
+  }
+  const f64 = new Float64Array(1);
+  f64[0] = val;
+  const u32 = new Uint32Array(f64.buffer);
+  const isNegative = u32[1] >>> 31 === 1;
+  return isNegative;
+}
+function toString(v) {
+  return Object.prototype.toString.call(v);
+}
+function isPlainObject(val) {
+  return toString(val) === "[object Object]" && (!val.constructor || val.constructor.name === "Object");
+}
+function isMergeableObject(item) {
+  return isPlainObject(item) && !Array.isArray(item);
+}
+function deepMerge(target, ...sources) {
+  if (!sources.length) {
+    return target;
+  }
+  const source = sources.shift();
+  if (source === void 0) {
+    return target;
+  }
+  if (isMergeableObject(target) && isMergeableObject(source)) {
+    Object.keys(source).forEach((key) => {
+      const _source = source;
+      if (isMergeableObject(_source[key])) {
+        if (!target[key]) {
+          target[key] = {};
+        }
+        deepMerge(target[key], _source[key]);
+      } else {
+        target[key] = _source[key];
+      }
+    });
+  }
+  return deepMerge(target, ...sources);
+}
+
+export { assertTypes, clone, createDefer, createSimpleStackTrace, deepClone, deepMerge, getCallLastIndex, getOwnProperties, getType, isNegativeNaN, isObject, isPrimitive, noop, notNullish, objectAttr, parseRegexp, slash, toArray };