feat: Phase 1 — extract the client (web SPA + desktop) to dtoro/oikos-web

Problem: the hexagonal refactor churns the backend tree for nine more
phases; the UI delivery stack (web/ SPA, cmd/desktop Wails wrapper,
compose/web image) must move to its own repo first so doc/layout
rewrites land once on a backend-only tree.

Change:
- New repo git.hubris.network/dtoro/oikos-web (v0.33.0): web/, desktop/
  (updateURL repointed to oikos-web releases), compose/, own CI (web +
  desktop jobs), own deploy script (CI-green gate, TOCTOU guard,
  version-tagged images, prune-to-3), own webhook receiver on :9798 +
  launchd unit, own compose project publishing the same 8091:80.
- Cutover executed on mac-mini in order: oikos stack's web service
  stopped+removed, oikos-web project brought up on 8091; outer Caddy
  untouched (targets the published port) — serving + Authentik flow +
  /wails 404 quirk verified post-cutover.
- Stripped from oikos: web/, cmd/desktop/, compose/web/, desktop CI
  workflow, ci.yml web job, Makefile ui/desktop/desktop-package/install
  targets, the compose web service, oikos-web from deploy.sh's fallback
  prune list; wails + go-keyring dropped from go.mod, vendor synced.
- README / CONTRIBUTING / AGENTS.md / .agents dev+operations docs now
  point at the new repo; mbse + mascot design docs carry a path note.

Risk: production SPA serving depends on the new pipeline now; rollback
is versioned-image re-up of the old web service from a pre-split
checkout (port 8091). Desktop builds installed before the split still
check dtoro/oikos releases — one manual reinstall, noted in the
oikos-web release notes.

Verification: go vet, make test (race), make generate-check, golangci
(no new findings; baseline down 400→365); post-cutover curls —
localhost:8091 200, /wails/runtime.js 404, outer Caddy 302 Authentik.

web/node_modules/bits-ui/dist/bits/context-menu/components/context-menu-content-static.svelte

@@ -0,0 +1,135 @@
+<script lang="ts">
+	import { boxWith, mergeProps } from "svelte-toolbelt";
+	import type { ContextMenuContentStaticProps } from "../types.js";
+	import { CONTEXT_MENU_TRIGGER_ATTR, MenuContentState } from "../../menu/menu.svelte.js";
+	import { useId } from "../../../internal/use-id.js";
+	import { noop } from "../../../internal/noop.js";
+	import PopperLayer from "../../utilities/popper-layer/popper-layer.svelte";
+	import { getFloatingContentCSSVars } from "../../../internal/floating-svelte/floating-utils.svelte.js";
+	import PopperLayerForceMount from "../../utilities/popper-layer/popper-layer-force-mount.svelte";
+
+	let {
+		id = useId(),
+		child,
+		children,
+		ref = $bindable(null),
+		loop = true,
+		onInteractOutside = noop,
+		onCloseAutoFocus = noop,
+		preventScroll = true,
+		// we need to explicitly pass this prop to the PopperLayer to override
+		// the default menu behavior of handling outside interactions on the trigger
+		onEscapeKeydown = noop,
+		forceMount = false,
+		style,
+		...restProps
+	}: ContextMenuContentStaticProps = $props();
+
+	const contentState = MenuContentState.create({
+		id: boxWith(() => id),
+		loop: boxWith(() => loop),
+		ref: boxWith(
+			() => ref,
+			(v) => (ref = v)
+		),
+		onCloseAutoFocus: boxWith(() => onCloseAutoFocus),
+	});
+
+	const mergedProps = $derived(mergeProps(restProps, contentState.props));
+
+	function handleInteractOutside(e: PointerEvent) {
+		onInteractOutside(e);
+		if (e.defaultPrevented) return;
+		contentState.parentMenu.onClose();
+	}
+
+	function handleEscapeKeydown(e: KeyboardEvent) {
+		onEscapeKeydown(e);
+		if (e.defaultPrevented) return;
+		contentState.parentMenu.onClose();
+	}
+
+	function isValidEvent(e: PointerEvent) {
+		if ("button" in e && e.button === 2) {
+			const target = e.target as HTMLElement;
+			if (!target) return false;
+			const isAnotherContextTrigger =
+				target.closest(`[${CONTEXT_MENU_TRIGGER_ATTR}]`) !==
+				contentState.parentMenu.triggerNode;
+			return isAnotherContextTrigger;
+		}
+		return false;
+	}
+</script>
+
+{#if forceMount}
+	<PopperLayerForceMount
+		{...mergedProps}
+		{...contentState.popperProps}
+		ref={contentState.opts.ref}
+		isStatic
+		side="right"
+		sideOffset={2}
+		align="start"
+		enabled={contentState.parentMenu.opts.open.current}
+		{preventScroll}
+		onInteractOutside={handleInteractOutside}
+		onEscapeKeydown={handleEscapeKeydown}
+		{isValidEvent}
+		trapFocus
+		{loop}
+		{forceMount}
+		{id}
+		shouldRender={contentState.shouldRender}
+	>
+		{#snippet popper({ props })}
+			{@const finalProps = mergeProps(
+				props,
+				{ style: getFloatingContentCSSVars("context-menu") },
+				{ style }
+			)}
+			{#if child}
+				{@render child({ props: finalProps, ...contentState.snippetProps })}
+			{:else}
+				<div {...finalProps}>
+					{@render children?.()}
+				</div>
+			{/if}
+		{/snippet}
+	</PopperLayerForceMount>
+{:else if !forceMount}
+	<PopperLayer
+		{...mergedProps}
+		{...contentState.popperProps}
+		ref={contentState.opts.ref}
+		isStatic
+		side="right"
+		sideOffset={2}
+		align="start"
+		open={contentState.parentMenu.opts.open.current}
+		{preventScroll}
+		onInteractOutside={handleInteractOutside}
+		onEscapeKeydown={handleEscapeKeydown}
+		{isValidEvent}
+		trapFocus
+		{loop}
+		forceMount={false}
+		{id}
+		shouldRender={contentState.shouldRender}
+	>
+		{#snippet popper({ props })}
+			{@const finalProps = mergeProps(
+				props,
+				{ style: getFloatingContentCSSVars("context-menu") },
+				{ style }
+			)}
+			{#if child}
+				{@render child({ props: finalProps, ...contentState.snippetProps })}
+			{:else}
+				<div {...finalProps}>
+					{@render children?.()}
+				</div>
+			{/if}
+		{/snippet}
+	</PopperLayer>
+{/if}

web/node_modules/bits-ui/dist/bits/context-menu/components/context-menu-content-static.svelte.d.ts

@@ -0,0 +1,4 @@
+import type { ContextMenuContentStaticProps } from "../types.js";
+declare const ContextMenuContentStatic: import("svelte").Component<ContextMenuContentStaticProps, {}, "ref">;
+type ContextMenuContentStatic = ReturnType<typeof ContextMenuContentStatic>;
+export default ContextMenuContentStatic;

web/node_modules/bits-ui/dist/bits/context-menu/components/context-menu-content.svelte

@@ -0,0 +1,138 @@
+<script lang="ts">
+	import { boxWith, mergeProps } from "svelte-toolbelt";
+	import type { ContextMenuContentProps } from "../types.js";
+	import { CONTEXT_MENU_TRIGGER_ATTR, MenuContentState } from "../../menu/menu.svelte.js";
+	import { useId } from "../../../internal/use-id.js";
+	import { noop } from "../../../internal/noop.js";
+	import PopperLayer from "../../utilities/popper-layer/popper-layer.svelte";
+	import { getFloatingContentCSSVars } from "../../../internal/floating-svelte/floating-utils.svelte.js";
+	import PopperLayerForceMount from "../../utilities/popper-layer/popper-layer-force-mount.svelte";
+
+	let {
+		id = useId(),
+		child,
+		children,
+		ref = $bindable(null),
+		loop = true,
+		onInteractOutside = noop,
+		onCloseAutoFocus = noop,
+		onOpenAutoFocus = noop,
+		preventScroll = true,
+		side = "right",
+		sideOffset = 2,
+		align = "start",
+		// we need to explicitly pass this prop to the PopperLayer to override
+		// the default menu behavior of handling outside interactions on the trigger
+		onEscapeKeydown = noop,
+		forceMount = false,
+		trapFocus = false,
+		style,
+		...restProps
+	}: ContextMenuContentProps = $props();
+
+	const contentState = MenuContentState.create({
+		id: boxWith(() => id),
+		loop: boxWith(() => loop),
+		ref: boxWith(
+			() => ref,
+			(v) => (ref = v)
+		),
+		onCloseAutoFocus: boxWith(() => onCloseAutoFocus),
+	});
+
+	const mergedProps = $derived(
+		mergeProps(restProps, contentState.props, {
+			side,
+			sideOffset,
+			align,
+			onOpenAutoFocus,
+			isValidEvent,
+			trapFocus,
+			loop,
+			id,
+			ref: contentState.opts.ref,
+			preventScroll,
+			onInteractOutside: handleInteractOutside,
+			onEscapeKeydown: handleEscapeKeydown,
+			shouldRender: contentState.shouldRender,
+		})
+	);
+
+	function handleInteractOutside(e: PointerEvent) {
+		onInteractOutside(e);
+		if (e.defaultPrevented) return;
+
+		// don't close if the interaction is with a submenu content or items
+		if (e.target && e.target instanceof Element) {
+			const subContentSelector = `[${contentState.parentMenu.root.getBitsAttr("sub-content")}]`;
+			if (e.target.closest(subContentSelector)) return;
+		}
+		contentState.parentMenu.onClose();
+	}
+
+	function handleEscapeKeydown(e: KeyboardEvent) {
+		onEscapeKeydown(e);
+		if (e.defaultPrevented) return;
+		contentState.parentMenu.onClose();
+	}
+
+	function isValidEvent(e: PointerEvent) {
+		if ("button" in e && e.button === 2) {
+			const target = e.target as HTMLElement;
+			if (!target) return false;
+			const isAnotherContextTrigger =
+				target.closest(`[${CONTEXT_MENU_TRIGGER_ATTR}]`) !==
+				contentState.parentMenu.triggerNode;
+			return isAnotherContextTrigger;
+		}
+		return false;
+	}
+</script>
+
+{#if forceMount}
+	<PopperLayerForceMount
+		{...mergedProps}
+		{...contentState.popperProps}
+		enabled={contentState.parentMenu.opts.open.current}
+	>
+		{#snippet popper({ props, wrapperProps })}
+			{@const finalProps = mergeProps(
+				props,
+				{ style: getFloatingContentCSSVars("context-menu") },
+				{ style }
+			)}
+			{#if child}
+				{@render child({ props: finalProps, wrapperProps, ...contentState.snippetProps })}
+			{:else}
+				<div {...wrapperProps}>
+					<div {...finalProps}>
+						{@render children?.()}
+					</div>
+				</div>
+			{/if}
+		{/snippet}
+	</PopperLayerForceMount>
+{:else if !forceMount}
+	<PopperLayer
+		{...mergedProps}
+		{...contentState.popperProps}
+		open={contentState.parentMenu.opts.open.current}
+	>
+		{#snippet popper({ props, wrapperProps })}
+			{@const finalProps = mergeProps(
+				props,
+				{ style: getFloatingContentCSSVars("context-menu") },
+				{ style }
+			)}
+			{#if child}
+				{@render child({ props: finalProps, wrapperProps, ...contentState.snippetProps })}
+			{:else}
+				<div {...wrapperProps}>
+					<div {...finalProps}>
+						{@render children?.()}
+					</div>
+				</div>
+			{/if}
+		{/snippet}
+	</PopperLayer>
+{/if}

web/node_modules/bits-ui/dist/bits/context-menu/components/context-menu-content.svelte.d.ts

@@ -0,0 +1,3 @@
+declare const ContextMenuContent: import("svelte").Component<import("../../menu/types.js").MenuContentProps, {}, "ref">;
+type ContextMenuContent = ReturnType<typeof ContextMenuContent>;
+export default ContextMenuContent;

web/node_modules/bits-ui/dist/bits/context-menu/components/context-menu-trigger.svelte

@@ -0,0 +1,47 @@
+<script lang="ts">
+	import { boxWith, mergeProps } from "svelte-toolbelt";
+	import type { ContextMenuTriggerProps } from "../types.js";
+	import { ContextMenuTriggerState } from "../../menu/menu.svelte.js";
+	import { useId } from "../../../internal/use-id.js";
+	import { FloatingLayer } from "../../utilities/floating-layer/index.js";
+
+	let {
+		id = useId(),
+		ref = $bindable(null),
+		child,
+		children,
+		disabled = false,
+		...restProps
+	}: ContextMenuTriggerProps = $props();
+
+	const triggerState = ContextMenuTriggerState.create({
+		id: boxWith(() => id),
+		disabled: boxWith(() => disabled),
+		ref: boxWith(
+			() => ref,
+			(v) => (ref = v)
+		),
+	});
+
+	const mergedProps = $derived(
+		mergeProps(
+			restProps,
+			triggerState.props,
+			{ style: { pointerEvents: "auto" } },
+			{
+				style: restProps.style,
+				tabindex: restProps.tabindex,
+			}
+		)
+	);
+</script>
+
+<FloatingLayer.Anchor {id} virtualEl={triggerState.virtualElement} ref={triggerState.opts.ref}>
+	{#if child}
+		{@render child({ props: mergedProps })}
+	{:else}
+		<div {...mergedProps}>
+			{@render children?.()}
+		</div>
+	{/if}
+</FloatingLayer.Anchor>

web/node_modules/bits-ui/dist/bits/context-menu/components/context-menu-trigger.svelte.d.ts

@@ -0,0 +1,4 @@
+import type { ContextMenuTriggerProps } from "../types.js";
+declare const ContextMenuTrigger: import("svelte").Component<ContextMenuTriggerProps, {}, "ref">;
+type ContextMenuTrigger = ReturnType<typeof ContextMenuTrigger>;
+export default ContextMenuTrigger;

web/node_modules/bits-ui/dist/bits/context-menu/components/context-menu.svelte

@@ -0,0 +1,44 @@
+<script lang="ts">
+	import { boxWith } from "svelte-toolbelt";
+	import type { ContextMenuRootProps } from "../types.js";
+	import FloatingLayer from "../../utilities/floating-layer/components/floating-layer.svelte";
+	import { noop } from "../../../internal/noop.js";
+	import { MenuMenuState, MenuRootState } from "../../menu/menu.svelte.js";
+
+	let {
+		open = $bindable(false),
+		dir = "ltr",
+		// debugMode = false,
+		onOpenChange = noop,
+		onOpenChangeComplete = noop,
+		children,
+	}: ContextMenuRootProps = $props();
+
+	const root = MenuRootState.create({
+		variant: boxWith(() => "context-menu" as const),
+		dir: boxWith(() => dir),
+		// debugMode: boxWith(() => debugMode),
+		onClose: () => {
+			open = false;
+			onOpenChange?.(false);
+		},
+	});
+
+	MenuMenuState.create(
+		{
+			open: boxWith(
+				() => open,
+				(v) => {
+					open = v;
+					onOpenChange(v);
+				}
+			),
+			onOpenChangeComplete: boxWith(() => onOpenChangeComplete),
+		},
+		root
+	);
+</script>
+
+<FloatingLayer>
+	{@render children?.()}
+</FloatingLayer>

web/node_modules/bits-ui/dist/bits/context-menu/components/context-menu.svelte.d.ts

@@ -0,0 +1,3 @@
+declare const ContextMenu: import("svelte").Component<import("../types.js").ContextMenuRootPropsWithoutHTML, {}, "open">;
+type ContextMenu = ReturnType<typeof ContextMenu>;
+export default ContextMenu;

web/node_modules/bits-ui/dist/bits/context-menu/exports.d.ts

@@ -0,0 +1,19 @@
+export { default as Root } from "./components/context-menu.svelte";
+export { default as Sub } from "../menu/components/menu-sub.svelte";
+export { default as Item } from "../menu/components/menu-item.svelte";
+export { default as Group } from "../menu/components/menu-group.svelte";
+export { default as GroupHeading } from "../menu/components/menu-group-heading.svelte";
+export { default as Arrow } from "../menu/components/menu-arrow.svelte";
+export { default as Content } from "./components/context-menu-content.svelte";
+export { default as ContentStatic } from "./components/context-menu-content-static.svelte";
+export { default as Trigger } from "./components/context-menu-trigger.svelte";
+export { default as RadioItem } from "../menu/components/menu-radio-item.svelte";
+export { default as Separator } from "../menu/components/menu-separator.svelte";
+export { default as RadioGroup } from "../menu/components/menu-radio-group.svelte";
+export { default as SubContent } from "../menu/components/menu-sub-content.svelte";
+export { default as SubContentStatic } from "../menu/components/menu-sub-content-static.svelte";
+export { default as SubTrigger } from "../menu/components/menu-sub-trigger.svelte";
+export { default as CheckboxItem } from "../menu/components/menu-checkbox-item.svelte";
+export { default as Portal } from "../utilities/portal/portal.svelte";
+export { default as CheckboxGroup } from "../menu/components/menu-checkbox-group.svelte";
+export type { ContextMenuArrowProps as ArrowProps, ContextMenuCheckboxItemProps as CheckboxItemProps, ContextMenuGroupProps as GroupProps, ContextMenuItemProps as ItemProps, ContextMenuGroupHeadingProps as GroupHeadingProps, ContextMenuRootProps as RootProps, ContextMenuRadioGroupProps as RadioGroupProps, ContextMenuRadioItemProps as RadioItemProps, ContextMenuSeparatorProps as SeparatorProps, ContextMenuSubContentProps as SubContentProps, ContextMenuSubContentStaticProps as SubContentStaticProps, ContextMenuSubProps as SubProps, ContextMenuSubTriggerProps as SubTriggerProps, ContextMenuContentProps as ContentProps, ContextMenuContentStaticProps as ContentStaticProps, ContextMenuTriggerProps as TriggerProps, ContextMenuPortalProps as PortalProps, ContextMenuCheckboxGroupProps as CheckboxGroupProps, } from "./types.js";

web/node_modules/bits-ui/dist/bits/context-menu/exports.js

@@ -0,0 +1,18 @@
+export { default as Root } from "./components/context-menu.svelte";
+export { default as Sub } from "../menu/components/menu-sub.svelte";
+export { default as Item } from "../menu/components/menu-item.svelte";
+export { default as Group } from "../menu/components/menu-group.svelte";
+export { default as GroupHeading } from "../menu/components/menu-group-heading.svelte";
+export { default as Arrow } from "../menu/components/menu-arrow.svelte";
+export { default as Content } from "./components/context-menu-content.svelte";
+export { default as ContentStatic } from "./components/context-menu-content-static.svelte";
+export { default as Trigger } from "./components/context-menu-trigger.svelte";
+export { default as RadioItem } from "../menu/components/menu-radio-item.svelte";
+export { default as Separator } from "../menu/components/menu-separator.svelte";
+export { default as RadioGroup } from "../menu/components/menu-radio-group.svelte";
+export { default as SubContent } from "../menu/components/menu-sub-content.svelte";
+export { default as SubContentStatic } from "../menu/components/menu-sub-content-static.svelte";
+export { default as SubTrigger } from "../menu/components/menu-sub-trigger.svelte";
+export { default as CheckboxItem } from "../menu/components/menu-checkbox-item.svelte";
+export { default as Portal } from "../utilities/portal/portal.svelte";
+export { default as CheckboxGroup } from "../menu/components/menu-checkbox-group.svelte";

web/node_modules/bits-ui/dist/bits/context-menu/index.d.ts

@@ -0,0 +1 @@
+export * as ContextMenu from "./exports.js";

web/node_modules/bits-ui/dist/bits/context-menu/index.js

@@ -0,0 +1 @@
+export * as ContextMenu from "./exports.js";

web/node_modules/bits-ui/dist/bits/context-menu/types.d.ts

@@ -0,0 +1,15 @@
+import type { MenuContentProps, MenuContentPropsWithoutHTML } from "../menu/types.js";
+import type { WithChild, Without } from "../../internal/types.js";
+import type { BitsPrimitiveDivAttributes } from "../../shared/attributes.js";
+export type ContextMenuContentPropsWithoutHTML = MenuContentPropsWithoutHTML;
+export type ContextMenuContentProps = MenuContentProps;
+export type ContextMenuTriggerPropsWithoutHTML = WithChild<{
+    /**
+     * Whether the context menu trigger is disabled. If disabled, the trigger will not
+     * open the menu when right-clicked.
+     */
+    disabled?: boolean;
+}>;
+export type ContextMenuTriggerProps = ContextMenuTriggerPropsWithoutHTML & Without<BitsPrimitiveDivAttributes, ContextMenuTriggerPropsWithoutHTML>;
+export type { MenuArrowProps as ContextMenuArrowProps, MenuContentStaticProps as ContextMenuContentStaticProps, MenuCheckboxItemProps as ContextMenuCheckboxItemProps, MenuGroupProps as ContextMenuGroupProps, MenuItemProps as ContextMenuItemProps, MenuGroupHeadingProps as ContextMenuGroupHeadingProps, MenuRootProps as ContextMenuRootProps, MenuRadioGroupProps as ContextMenuRadioGroupProps, MenuRadioItemProps as ContextMenuRadioItemProps, MenuSeparatorProps as ContextMenuSeparatorProps, MenuSubContentProps as ContextMenuSubContentProps, MenuSubContentStaticProps as ContextMenuSubContentStaticProps, MenuSubProps as ContextMenuSubProps, MenuSubTriggerProps as ContextMenuSubTriggerProps, MenuPortalProps as ContextMenuPortalProps, MenuCheckboxGroupProps as ContextMenuCheckboxGroupProps, } from "../menu/types.js";
+export type { MenuRootPropsWithoutHTML as ContextMenuRootPropsWithoutHTML, MenuContentStaticPropsWithoutHTML as ContextMenuContentStaticPropsWithoutHTML, MenuArrowPropsWithoutHTML as ContextMenuArrowPropsWithoutHTML, MenuCheckboxItemPropsWithoutHTML as ContextMenuCheckboxItemPropsWithoutHTML, MenuGroupPropsWithoutHTML as ContextMenuGroupPropsWithoutHTML, MenuItemPropsWithoutHTML as ContextMenuItemPropsWithoutHTML, MenuGroupHeadingPropsWithoutHTML as ContextMenuGroupHeadingPropsWithoutHTML, MenuRadioGroupPropsWithoutHTML as ContextMenuRadioGroupPropsWithoutHTML, MenuRadioItemPropsWithoutHTML as ContextMenuRadioItemPropsWithoutHTML, MenuSeparatorPropsWithoutHTML as ContextMenuSeparatorPropsWithoutHTML, MenuSubPropsWithoutHTML as ContextMenuSubPropsWithoutHTML, MenuSubTriggerPropsWithoutHTML as ContextMenuSubTriggerPropsWithoutHTML, MenuSubContentPropsWithoutHTML as ContextMenuSubContentPropsWithoutHTML, MenuSubContentStaticPropsWithoutHTML as ContextMenuSubContentStaticPropsWithoutHTML, MenuPortalPropsWithoutHTML as ContextMenuPortalPropsWithoutHTML, MenuCheckboxGroupPropsWithoutHTML as ContextMenuCheckboxGroupPropsWithoutHTML, } from "../menu/types.js";

web/node_modules/bits-ui/dist/bits/context-menu/types.js

@@ -0,0 +1 @@
+export {};