feat: Phase 1 — extract the client (web SPA + desktop) to dtoro/oikos-web

Problem: the hexagonal refactor churns the backend tree for nine more
phases; the UI delivery stack (web/ SPA, cmd/desktop Wails wrapper,
compose/web image) must move to its own repo first so doc/layout
rewrites land once on a backend-only tree.

Change:
- New repo git.hubris.network/dtoro/oikos-web (v0.33.0): web/, desktop/
  (updateURL repointed to oikos-web releases), compose/, own CI (web +
  desktop jobs), own deploy script (CI-green gate, TOCTOU guard,
  version-tagged images, prune-to-3), own webhook receiver on :9798 +
  launchd unit, own compose project publishing the same 8091:80.
- Cutover executed on mac-mini in order: oikos stack's web service
  stopped+removed, oikos-web project brought up on 8091; outer Caddy
  untouched (targets the published port) — serving + Authentik flow +
  /wails 404 quirk verified post-cutover.
- Stripped from oikos: web/, cmd/desktop/, compose/web/, desktop CI
  workflow, ci.yml web job, Makefile ui/desktop/desktop-package/install
  targets, the compose web service, oikos-web from deploy.sh's fallback
  prune list; wails + go-keyring dropped from go.mod, vendor synced.
- README / CONTRIBUTING / AGENTS.md / .agents dev+operations docs now
  point at the new repo; mbse + mascot design docs carry a path note.

Risk: production SPA serving depends on the new pipeline now; rollback
is versioned-image re-up of the old web service from a pre-split
checkout (port 8091). Desktop builds installed before the split still
check dtoro/oikos releases — one manual reinstall, noted in the
oikos-web release notes.

Verification: go vet, make test (race), make generate-check, golangci
(no new findings; baseline down 400→365); post-cutover curls —
localhost:8091 200, /wails/runtime.js 404, outer Caddy 302 Authentik.

web/node_modules/.vite/deps/svelte_reactivity_window.js

@@ -0,0 +1,132 @@
+import {
+  ReactiveValue
+} from "./chunk-7WAVL53H.js";
+import "./chunk-7RQDXF5S.js";
+import "./chunk-3SEKS52A.js";
+import "./chunk-YWNCLLEK.js";
+import "./chunk-U7P2NEEE.js";
+import {
+  on
+} from "./chunk-RK6BZSGT.js";
+import {
+  get2 as get,
+  set,
+  source,
+  tag
+} from "./chunk-IFIY7NGJ.js";
+import {
+  true_default
+} from "./chunk-QDDRZFWN.js";
+import "./chunk-OHYQYV5R.js";
+import {
+  __privateAdd,
+  __privateGet,
+  __privateMethod
+} from "./chunk-KWPVD4H7.js";
+
+// node_modules/svelte/src/reactivity/window/index.js
+var scrollX = new ReactiveValue(
+  true_default ? () => window.scrollX : () => void 0,
+  (update) => on(window, "scroll", update)
+);
+var scrollY = new ReactiveValue(
+  true_default ? () => window.scrollY : () => void 0,
+  (update) => on(window, "scroll", update)
+);
+var innerWidth = new ReactiveValue(
+  true_default ? () => window.innerWidth : () => void 0,
+  (update) => on(window, "resize", update)
+);
+var innerHeight = new ReactiveValue(
+  true_default ? () => window.innerHeight : () => void 0,
+  (update) => on(window, "resize", update)
+);
+var outerWidth = new ReactiveValue(
+  true_default ? () => window.outerWidth : () => void 0,
+  (update) => on(window, "resize", update)
+);
+var outerHeight = new ReactiveValue(
+  true_default ? () => window.outerHeight : () => void 0,
+  (update) => on(window, "resize", update)
+);
+var screenLeft = new ReactiveValue(
+  true_default ? () => window.screenLeft : () => void 0,
+  (update) => {
+    let value = window.screenLeft;
+    let frame = requestAnimationFrame(function check() {
+      frame = requestAnimationFrame(check);
+      if (value !== (value = window.screenLeft)) {
+        update();
+      }
+    });
+    return () => {
+      cancelAnimationFrame(frame);
+    };
+  }
+);
+var screenTop = new ReactiveValue(
+  true_default ? () => window.screenTop : () => void 0,
+  (update) => {
+    let value = window.screenTop;
+    let frame = requestAnimationFrame(function check() {
+      frame = requestAnimationFrame(check);
+      if (value !== (value = window.screenTop)) {
+        update();
+      }
+    });
+    return () => {
+      cancelAnimationFrame(frame);
+    };
+  }
+);
+var online = new ReactiveValue(
+  true_default ? () => navigator.onLine : () => void 0,
+  (update) => {
+    const unsub_online = on(window, "online", update);
+    const unsub_offline = on(window, "offline", update);
+    return () => {
+      unsub_online();
+      unsub_offline();
+    };
+  }
+);
+var _dpr, _DevicePixelRatio_instances, update_fn, _a;
+var devicePixelRatio = new (_a = class {
+  constructor() {
+    __privateAdd(this, _DevicePixelRatio_instances);
+    __privateAdd(this, _dpr, source(true_default ? window.devicePixelRatio : void 0));
+    if (true_default) {
+      __privateMethod(this, _DevicePixelRatio_instances, update_fn).call(this);
+    }
+    if (true_default) {
+      tag(__privateGet(this, _dpr), "window.devicePixelRatio");
+    }
+  }
+  get current() {
+    get(__privateGet(this, _dpr));
+    return true_default ? window.devicePixelRatio : void 0;
+  }
+}, _dpr = new WeakMap(), _DevicePixelRatio_instances = new WeakSet(), update_fn = function() {
+  const off = on(
+    window.matchMedia(`(resolution: ${window.devicePixelRatio}dppx)`),
+    "change",
+    () => {
+      set(__privateGet(this, _dpr), window.devicePixelRatio);
+      off();
+      __privateMethod(this, _DevicePixelRatio_instances, update_fn).call(this);
+    }
+  );
+}, _a)();
+export {
+  devicePixelRatio,
+  innerHeight,
+  innerWidth,
+  online,
+  outerHeight,
+  outerWidth,
+  screenLeft,
+  screenTop,
+  scrollX,
+  scrollY
+};
+//# sourceMappingURL=svelte_reactivity_window.js.map