feat: Phase 1 — extract the client (web SPA + desktop) to dtoro/oikos-web

Problem: the hexagonal refactor churns the backend tree for nine more
phases; the UI delivery stack (web/ SPA, cmd/desktop Wails wrapper,
compose/web image) must move to its own repo first so doc/layout
rewrites land once on a backend-only tree.

Change:
- New repo git.hubris.network/dtoro/oikos-web (v0.33.0): web/, desktop/
  (updateURL repointed to oikos-web releases), compose/, own CI (web +
  desktop jobs), own deploy script (CI-green gate, TOCTOU guard,
  version-tagged images, prune-to-3), own webhook receiver on :9798 +
  launchd unit, own compose project publishing the same 8091:80.
- Cutover executed on mac-mini in order: oikos stack's web service
  stopped+removed, oikos-web project brought up on 8091; outer Caddy
  untouched (targets the published port) — serving + Authentik flow +
  /wails 404 quirk verified post-cutover.
- Stripped from oikos: web/, cmd/desktop/, compose/web/, desktop CI
  workflow, ci.yml web job, Makefile ui/desktop/desktop-package/install
  targets, the compose web service, oikos-web from deploy.sh's fallback
  prune list; wails + go-keyring dropped from go.mod, vendor synced.
- README / CONTRIBUTING / AGENTS.md / .agents dev+operations docs now
  point at the new repo; mbse + mascot design docs carry a path note.

Risk: production SPA serving depends on the new pipeline now; rollback
is versioned-image re-up of the old web service from a pre-split
checkout (port 8091). Desktop builds installed before the split still
check dtoro/oikos releases — one manual reinstall, noted in the
oikos-web release notes.

Verification: go vet, make test (race), make generate-check, golangci
(no new findings; baseline down 400→365); post-cutover curls —
localhost:8091 200, /wails/runtime.js 404, outer Caddy 302 Authentik.

web/node_modules/assertion-error/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2013 Jake Luer jake@qualiancy.com (http://qualiancy.com)
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

web/node_modules/assertion-error/README.md

@@ -0,0 +1,68 @@
+<p align=center>
+  AssertionError and AssertionResult classes.
+</p>
+
+<p align=center>
+  <a href="https://github.com/chaijs/assertion-error/actions">
+    <img
+      alt="build:?"
+      src="https://github.com/chaijs/assertion-error/actions/workflows/nodejs.yml/badge.svg"
+    />
+  </a><a href="https://www.npmjs.com/package/assertion-error">
+    <img
+      alt="downloads:?"
+      src="https://img.shields.io/npm/dm/assertion-error.svg"
+    />
+  </a><a href="">
+    <img
+      alt="devDependencies:none"
+      src="https://img.shields.io/badge/dependencies-none-brightgreen"
+    />
+  </a>
+</p>
+
+## What is AssertionError?
+
+Assertion Error is a module that contains two classes: `AssertionError`, which
+is an instance of an `Error`, and `AssertionResult` which is not an instance of
+Error.
+
+These can be useful for returning from a function - if the function "succeeds"
+return an `AssertionResult` and if the function fails return (or throw) an
+`AssertionError`.
+
+Both `AssertionError` and `AssertionResult` implement the `Result` interface:
+
+```typescript
+interface Result {
+  name: "AssertionError" | "AssertionResult";
+  ok: boolean;
+  toJSON(...args: unknown[]): Record<string, unknown>;
+}
+```
+
+So if a function returns `AssertionResult | AssertionError` it is easy to check
+_which_ one is returned by checking either `.name` or `.ok`, or check
+`instanceof Error`.
+
+## Installation
+
+### Node.js
+
+`assertion-error` is available on [npm](http://npmjs.org).
+
+```
+$ npm install --save assertion-error
+```
+
+### Deno
+
+`assertion_error` is available on
+[Deno.land](https://deno.land/x/assertion_error)
+
+```typescript
+import {
+  AssertionError,
+  AssertionResult,
+} from "https://deno.land/x/assertion_error@2.0.0/mod.ts";
+```

web/node_modules/assertion-error/index.d.ts

@@ -0,0 +1,27 @@
+interface Result {
+  name: "AssertionError" | "AssertionResult";
+  ok: boolean;
+  toJSON(...args: unknown[]): Record<string, unknown>;
+}
+
+declare class AssertionError<T> extends Error implements Result {
+  [key: string]: unknown
+  name: "AssertionError";
+  ok: false;
+  message: string;
+  // deno-lint-ignore ban-types
+  constructor(message: string, props?: T, ssf?: Function);
+  stack: string;
+  toJSON(stack?: boolean): Record<string, unknown>;
+}
+
+declare class AssertionResult<T> implements Result {
+  [key: string]: unknown
+  name: "AssertionResult";
+  ok: true;
+  message: string;
+  constructor(props?: T);
+  toJSON(): Record<string, unknown>;
+}
+
+export { AssertionError, AssertionResult, Result };

web/node_modules/assertion-error/index.js

@@ -0,0 +1,60 @@
+// deno-fmt-ignore-file
+// deno-lint-ignore-file
+// This code was bundled using `deno bundle` and it's not recommended to edit it manually
+
+const canElideFrames = "captureStackTrace" in Error;
+class AssertionError extends Error {
+    message;
+    get name() {
+        return "AssertionError";
+    }
+    get ok() {
+        return false;
+    }
+    constructor(message = "Unspecified AssertionError", props, ssf){
+        super(message);
+        this.message = message;
+        if (canElideFrames) {
+            Error.captureStackTrace(this, ssf || AssertionError);
+        }
+        for(const key in props){
+            if (!(key in this)) {
+                this[key] = props[key];
+            }
+        }
+    }
+    toJSON(stack) {
+        return {
+            ...this,
+            name: this.name,
+            message: this.message,
+            ok: false,
+            stack: stack !== false ? this.stack : undefined
+        };
+    }
+}
+class AssertionResult {
+    get name() {
+        return "AssertionResult";
+    }
+    get ok() {
+        return true;
+    }
+    constructor(props){
+        for(const key in props){
+            if (!(key in this)) {
+                this[key] = props[key];
+            }
+        }
+    }
+    toJSON() {
+        return {
+            ...this,
+            name: this.name,
+            ok: this.ok
+        };
+    }
+}
+export { AssertionError as AssertionError };
+export { AssertionResult as AssertionResult };
+

web/node_modules/assertion-error/package.json

@@ -0,0 +1,32 @@
+{
+  "name": "assertion-error",
+  "version": "2.0.1",
+  "description": "Error constructor for test and validation frameworks that implements standardized AssertionError specification.",
+  "author": "Jake Luer <jake@qualiancy.com> (http://qualiancy.com)",
+  "license": "MIT",
+  "types": "./index.d.ts",
+  "keywords": [
+    "test",
+    "assertion",
+    "assertion-error"
+  ],
+  "repository": {
+    "type": "git",
+    "url": "git@github.com:chaijs/assertion-error.git"
+  },
+  "engines": {
+    "node": ">=12"
+  },
+  "files": [
+    "index.d.ts"
+  ],
+  "type": "module",
+  "module": "index.js",
+  "main": "index.js",
+  "scripts": {
+    "build": "deno bundle mod.ts > index.js",
+    "pretest": "rm -rf coverage/",
+    "test": "deno test --coverage=coverage",
+    "posttest": "deno coverage coverage --lcov > coverage/lcov.info && lcov --summary coverage/lcov.info"
+  }
+}