feat: Phase 1 — extract the client (web SPA + desktop) to dtoro/oikos-web

Problem: the hexagonal refactor churns the backend tree for nine more
phases; the UI delivery stack (web/ SPA, cmd/desktop Wails wrapper,
compose/web image) must move to its own repo first so doc/layout
rewrites land once on a backend-only tree.

Change:
- New repo git.hubris.network/dtoro/oikos-web (v0.33.0): web/, desktop/
  (updateURL repointed to oikos-web releases), compose/, own CI (web +
  desktop jobs), own deploy script (CI-green gate, TOCTOU guard,
  version-tagged images, prune-to-3), own webhook receiver on :9798 +
  launchd unit, own compose project publishing the same 8091:80.
- Cutover executed on mac-mini in order: oikos stack's web service
  stopped+removed, oikos-web project brought up on 8091; outer Caddy
  untouched (targets the published port) — serving + Authentik flow +
  /wails 404 quirk verified post-cutover.
- Stripped from oikos: web/, cmd/desktop/, compose/web/, desktop CI
  workflow, ci.yml web job, Makefile ui/desktop/desktop-package/install
  targets, the compose web service, oikos-web from deploy.sh's fallback
  prune list; wails + go-keyring dropped from go.mod, vendor synced.
- README / CONTRIBUTING / AGENTS.md / .agents dev+operations docs now
  point at the new repo; mbse + mascot design docs carry a path note.

Risk: production SPA serving depends on the new pipeline now; rollback
is versioned-image re-up of the old web service from a pre-split
checkout (port 8091). Desktop builds installed before the split still
check dtoro/oikos releases — one manual reinstall, noted in the
oikos-web release notes.

Verification: go vet, make test (race), make generate-check, golangci
(no new findings; baseline down 400→365); post-cutover curls —
localhost:8091 200, /wails/runtime.js 404, outer Caddy 302 Authentik.

web/node_modules/@vitest/utils/dist/index.d.ts

@@ -0,0 +1,55 @@
+import { PrettyFormatOptions } from '@vitest/pretty-format';
+export { DeferPromise, assertTypes, clone, createDefer, createSimpleStackTrace, deepClone, deepMerge, getCallLastIndex, getOwnProperties, getType, isNegativeNaN, isObject, isPrimitive, noop, notNullish, objectAttr, parseRegexp, slash, toArray } from './helpers.js';
+import { Colors } from 'tinyrainbow';
+export { ArgumentsType, Arrayable, Awaitable, Constructable, DeepMerge, ErrorWithDiff, MergeInsertions, MutableArray, Nullable, ParsedStack, SerializedError, TestError } from './types.js';
+
+type Inspect = (value: unknown, options: Options) => string;
+interface Options {
+    showHidden: boolean;
+    depth: number;
+    colors: boolean;
+    customInspect: boolean;
+    showProxy: boolean;
+    maxArrayLength: number;
+    breakLength: number;
+    truncate: number;
+    seen: unknown[];
+    inspect: Inspect;
+    stylize: (value: string, styleType: string) => string;
+}
+type LoupeOptions = Partial<Options>;
+interface StringifyOptions extends PrettyFormatOptions {
+    maxLength?: number;
+}
+declare function stringify(object: unknown, maxDepth?: number, { maxLength, ...options }?: StringifyOptions): string;
+declare function format(...args: unknown[]): string;
+declare function inspect(obj: unknown, options?: LoupeOptions): string;
+declare function objDisplay(obj: unknown, options?: LoupeOptions): string;
+
+interface HighlightOptions {
+    jsx?: boolean;
+    colors?: Colors;
+}
+declare function highlight(code: string, options?: HighlightOptions): string;
+
+declare function nanoid(size?: number): string;
+
+declare const lineSplitRE: RegExp;
+declare function positionToOffset(source: string, lineNumber: number, columnNumber: number): number;
+declare function offsetToLineNumber(source: string, offset: number): number;
+
+declare function shuffle<T>(array: T[], seed?: number): T[];
+
+interface SafeTimers {
+    nextTick: (cb: () => void) => void;
+    setTimeout: typeof setTimeout;
+    setInterval: typeof setInterval;
+    clearInterval: typeof clearInterval;
+    clearTimeout: typeof clearTimeout;
+    setImmediate: typeof setImmediate;
+    clearImmediate: typeof clearImmediate;
+}
+declare function getSafeTimers(): SafeTimers;
+declare function setSafeTimers(): void;
+
+export { type SafeTimers, type StringifyOptions, format, getSafeTimers, highlight, inspect, lineSplitRE, nanoid, objDisplay, offsetToLineNumber, positionToOffset, setSafeTimers, shuffle, stringify };