feat: Phase 1 — extract the client (web SPA + desktop) to dtoro/oikos-web

Problem: the hexagonal refactor churns the backend tree for nine more
phases; the UI delivery stack (web/ SPA, cmd/desktop Wails wrapper,
compose/web image) must move to its own repo first so doc/layout
rewrites land once on a backend-only tree.

Change:
- New repo git.hubris.network/dtoro/oikos-web (v0.33.0): web/, desktop/
  (updateURL repointed to oikos-web releases), compose/, own CI (web +
  desktop jobs), own deploy script (CI-green gate, TOCTOU guard,
  version-tagged images, prune-to-3), own webhook receiver on :9798 +
  launchd unit, own compose project publishing the same 8091:80.
- Cutover executed on mac-mini in order: oikos stack's web service
  stopped+removed, oikos-web project brought up on 8091; outer Caddy
  untouched (targets the published port) — serving + Authentik flow +
  /wails 404 quirk verified post-cutover.
- Stripped from oikos: web/, cmd/desktop/, compose/web/, desktop CI
  workflow, ci.yml web job, Makefile ui/desktop/desktop-package/install
  targets, the compose web service, oikos-web from deploy.sh's fallback
  prune list; wails + go-keyring dropped from go.mod, vendor synced.
- README / CONTRIBUTING / AGENTS.md / .agents dev+operations docs now
  point at the new repo; mbse + mascot design docs carry a path note.

Risk: production SPA serving depends on the new pipeline now; rollback
is versioned-image re-up of the old web service from a pre-split
checkout (port 8091). Desktop builds installed before the split still
check dtoro/oikos releases — one manual reinstall, noted in the
oikos-web release notes.

Verification: go vet, make test (race), make generate-check, golangci
(no new findings; baseline down 400→365); post-cutover curls —
localhost:8091 200, /wails/runtime.js 404, outer Caddy 302 Authentik.

web/node_modules/ajv/scripts/compile-dots.js

@@ -0,0 +1,73 @@
+//compile doT templates to js functions
+'use strict';
+
+var glob = require('glob')
+  , fs = require('fs')
+  , path = require('path')
+  , doT = require('dot')
+  , beautify = require('js-beautify').js_beautify;
+
+var defsRootPath = process.argv[2] || path.join(__dirname, '../lib');
+
+var defs = {};
+var defFiles = glob.sync('./dot/**/*.def', { cwd: defsRootPath });
+defFiles.forEach(function (f) {
+  var name = path.basename(f, '.def');
+  defs[name] = fs.readFileSync(path.join(defsRootPath, f));
+});
+
+var filesRootPath = process.argv[3] || path.join(__dirname, '../lib');
+var files = glob.sync('./dot/**/*.jst', { cwd: filesRootPath });
+
+var dotjsPath = path.join(filesRootPath, './dotjs');
+try { fs.mkdirSync(dotjsPath); } catch(e) {}
+
+console.log('\n\nCompiling:');
+
+var FUNCTION_NAME = /function\s+anonymous\s*\(it[^)]*\)\s*{/;
+var OUT_EMPTY_STRING = /out\s*\+=\s*'\s*';/g;
+var ISTANBUL = /'(istanbul[^']+)';/g;
+var ERROR_KEYWORD = /\$errorKeyword/g;
+var ERROR_KEYWORD_OR = /\$errorKeyword\s+\|\|/g;
+var VARS = [
+  '$errs', '$valid', '$lvl', '$data', '$dataLvl',
+  '$errorKeyword', '$closingBraces', '$schemaPath',
+  '$validate'
+];
+
+files.forEach(function (f) {
+  var keyword = path.basename(f, '.jst');
+  var targetPath = path.join(dotjsPath, keyword + '.js');
+  var template = fs.readFileSync(path.join(filesRootPath, f));
+  var code = doT.compile(template, defs);
+  code = code.toString()
+             .replace(OUT_EMPTY_STRING, '')
+             .replace(FUNCTION_NAME, 'function generate_' + keyword + '(it, $keyword, $ruleType) {')
+             .replace(ISTANBUL, '/* $1 */');
+  removeAlwaysFalsyInOr();
+  VARS.forEach(removeUnusedVar);
+  code = "'use strict';\nmodule.exports = " + code;
+  code = beautify(code, { indent_size: 2 }) + '\n';
+  fs.writeFileSync(targetPath, code);
+  console.log('compiled', keyword);
+
+  function removeUnusedVar(v) {
+    v = v.replace(/\$/g, '\\$$');
+    var regexp = new RegExp(v + '[^A-Za-z0-9_$]', 'g');
+    var count = occurrences(regexp);
+    if (count == 1) {
+      regexp = new RegExp('var\\s+' + v + '\\s*=[^;]+;|var\\s+' + v + ';');
+      code = code.replace(regexp, '');
+    }
+  }
+
+  function removeAlwaysFalsyInOr() {
+    var countUsed = occurrences(ERROR_KEYWORD);
+    var countOr = occurrences(ERROR_KEYWORD_OR);
+    if (countUsed == countOr + 1) code = code.replace(ERROR_KEYWORD_OR, '');
+  }
+
+  function occurrences(regexp) {
+    return (code.match(regexp) || []).length;
+  }
+});