feat: Phase 1 — extract the client (web SPA + desktop) to dtoro/oikos-web

Problem: the hexagonal refactor churns the backend tree for nine more
phases; the UI delivery stack (web/ SPA, cmd/desktop Wails wrapper,
compose/web image) must move to its own repo first so doc/layout
rewrites land once on a backend-only tree.

Change:
- New repo git.hubris.network/dtoro/oikos-web (v0.33.0): web/, desktop/
  (updateURL repointed to oikos-web releases), compose/, own CI (web +
  desktop jobs), own deploy script (CI-green gate, TOCTOU guard,
  version-tagged images, prune-to-3), own webhook receiver on :9798 +
  launchd unit, own compose project publishing the same 8091:80.
- Cutover executed on mac-mini in order: oikos stack's web service
  stopped+removed, oikos-web project brought up on 8091; outer Caddy
  untouched (targets the published port) — serving + Authentik flow +
  /wails 404 quirk verified post-cutover.
- Stripped from oikos: web/, cmd/desktop/, compose/web/, desktop CI
  workflow, ci.yml web job, Makefile ui/desktop/desktop-package/install
  targets, the compose web service, oikos-web from deploy.sh's fallback
  prune list; wails + go-keyring dropped from go.mod, vendor synced.
- README / CONTRIBUTING / AGENTS.md / .agents dev+operations docs now
  point at the new repo; mbse + mascot design docs carry a path note.

Risk: production SPA serving depends on the new pipeline now; rollback
is versioned-image re-up of the old web service from a pre-split
checkout (port 8091). Desktop builds installed before the split still
check dtoro/oikos releases — one manual reinstall, noted in the
oikos-web release notes.

Verification: go vet, make test (race), make generate-check, golangci
(no new findings; baseline down 400→365); post-cutover curls —
localhost:8091 200, /wails/runtime.js 404, outer Caddy 302 Authentik.

web/node_modules/ajv/lib/dot/uniqueItems.jst

@@ -0,0 +1,62 @@
+{{# def.definitions }}
+{{# def.errors }}
+{{# def.setupKeyword }}
+{{# def.$data }}
+
+
+{{? ($schema || $isData) && it.opts.uniqueItems !== false }}
+  {{? $isData }}
+    var {{=$valid}};
+    if ({{=$schemaValue}} === false || {{=$schemaValue}} === undefined)
+      {{=$valid}} = true;
+    else if (typeof {{=$schemaValue}} != 'boolean')
+      {{=$valid}} = false;
+    else {
+  {{?}}
+
+  var i = {{=$data}}.length
+    , {{=$valid}} = true
+    , j;
+  if (i > 1) {
+    {{
+      var $itemType = it.schema.items && it.schema.items.type
+        , $typeIsArray = Array.isArray($itemType);
+    }}
+    {{? !$itemType || $itemType == 'object' || $itemType == 'array' ||
+        ($typeIsArray && ($itemType.indexOf('object') >= 0 || $itemType.indexOf('array') >= 0)) }}
+      outer:
+      for (;i--;) {
+        for (j = i; j--;) {
+          if (equal({{=$data}}[i], {{=$data}}[j])) {
+            {{=$valid}} = false;
+            break outer;
+          }
+        }
+      }
+    {{??}}
+      var itemIndices = {}, item;
+      for (;i--;) {
+        var item = {{=$data}}[i];
+        {{ var $method = 'checkDataType' + ($typeIsArray ? 's' : ''); }}
+        if ({{= it.util[$method]($itemType, 'item', it.opts.strictNumbers, true) }}) continue;
+        {{? $typeIsArray}}
+          if (typeof item == 'string') item = '"' + item;
+        {{?}}
+        if (typeof itemIndices[item] == 'number') {
+          {{=$valid}} = false;
+          j = itemIndices[item];
+          break;
+        }
+        itemIndices[item] = i;
+      }
+    {{?}}
+  }
+
+  {{? $isData }}  }  {{?}}
+
+  if (!{{=$valid}}) {
+    {{# def.error:'uniqueItems' }}
+  } {{? $breakOnError }} else { {{?}}
+{{??}}
+  {{? $breakOnError }} if (true) { {{?}}
+{{?}}