feat: Phase 1 — extract the client (web SPA + desktop) to dtoro/oikos-web

Problem: the hexagonal refactor churns the backend tree for nine more
phases; the UI delivery stack (web/ SPA, cmd/desktop Wails wrapper,
compose/web image) must move to its own repo first so doc/layout
rewrites land once on a backend-only tree.

Change:
- New repo git.hubris.network/dtoro/oikos-web (v0.33.0): web/, desktop/
  (updateURL repointed to oikos-web releases), compose/, own CI (web +
  desktop jobs), own deploy script (CI-green gate, TOCTOU guard,
  version-tagged images, prune-to-3), own webhook receiver on :9798 +
  launchd unit, own compose project publishing the same 8091:80.
- Cutover executed on mac-mini in order: oikos stack's web service
  stopped+removed, oikos-web project brought up on 8091; outer Caddy
  untouched (targets the published port) — serving + Authentik flow +
  /wails 404 quirk verified post-cutover.
- Stripped from oikos: web/, cmd/desktop/, compose/web/, desktop CI
  workflow, ci.yml web job, Makefile ui/desktop/desktop-package/install
  targets, the compose web service, oikos-web from deploy.sh's fallback
  prune list; wails + go-keyring dropped from go.mod, vendor synced.
- README / CONTRIBUTING / AGENTS.md / .agents dev+operations docs now
  point at the new repo; mbse + mascot design docs carry a path note.

Risk: production SPA serving depends on the new pipeline now; rollback
is versioned-image re-up of the old web service from a pre-split
checkout (port 8091). Desktop builds installed before the split still
check dtoro/oikos releases — one manual reinstall, noted in the
oikos-web release notes.

Verification: go vet, make test (race), make generate-check, golangci
(no new findings; baseline down 400→365); post-cutover curls —
localhost:8091 200, /wails/runtime.js 404, outer Caddy 302 Authentik.

web/node_modules/bits-ui/dist/bits/utilities/config/bits-config.d.ts

@@ -0,0 +1,44 @@
+import { Context } from "runed";
+import { type ReadableBoxedValues } from "svelte-toolbelt";
+import type { BitsConfigPropsWithoutChildren } from "./types.js";
+type BitsConfigStateProps = ReadableBoxedValues<BitsConfigPropsWithoutChildren>;
+export declare const BitsConfigContext: Context<BitsConfigState>;
+/**
+ * Gets the current Bits UI configuration state from the context.
+ *
+ * Returns a default configuration (where all values are `undefined`) if no configuration is found.
+ */
+export declare function getBitsConfig(): Required<ReadableBoxedValues<BitsConfigPropsWithoutChildren>>;
+/**
+ * Creates and sets a new Bits UI configuration state that inherits from parent configs.
+ *
+ * @param opts - Configuration options for this level
+ * @returns The configuration state instance
+ *
+ * @example
+ * ```typescript
+ * // In a component that wants to set a default portal target
+ * const config = useBitsConfig({ defaultPortalTo: box("#some-element") });
+ *
+ * // Child components will inherit this config and can override specific values
+ * const childConfig = useBitsConfig({ someOtherProp: box("value") });
+ * // childConfig still has defaultPortalTo="#some-element" from parent
+ * ```
+ */
+export declare function useBitsConfig(opts: BitsConfigStateProps): BitsConfigState;
+/**
+ * Configuration state that inherits from parent configurations.
+ *
+ * @example
+ * Config resolution:
+ * ```
+ * Level 1: { defaultPortalTo: "#some-element", theme: "dark" }
+ * Level 2: { spacing: "large" } // inherits defaultPortalTo="#some-element", theme="dark"
+ * Level 3: { theme: "light" }   // inherits defaultPortalTo="#some-element", spacing="large", overrides theme="light"
+ * ```
+ */
+export declare class BitsConfigState {
+    readonly opts: Required<BitsConfigStateProps>;
+    constructor(parent: BitsConfigState | null, opts: BitsConfigStateProps);
+}
+export {};

web/node_modules/bits-ui/dist/bits/utilities/config/bits-config.js

@@ -0,0 +1,92 @@
+import { Context } from "runed";
+import { boxWith } from "svelte-toolbelt";
+export const BitsConfigContext = new Context("BitsConfig");
+/**
+ * Gets the current Bits UI configuration state from the context.
+ *
+ * Returns a default configuration (where all values are `undefined`) if no configuration is found.
+ */
+export function getBitsConfig() {
+    const fallback = new BitsConfigState(null, {});
+    return BitsConfigContext.getOr(fallback).opts;
+}
+/**
+ * Creates and sets a new Bits UI configuration state that inherits from parent configs.
+ *
+ * @param opts - Configuration options for this level
+ * @returns The configuration state instance
+ *
+ * @example
+ * ```typescript
+ * // In a component that wants to set a default portal target
+ * const config = useBitsConfig({ defaultPortalTo: box("#some-element") });
+ *
+ * // Child components will inherit this config and can override specific values
+ * const childConfig = useBitsConfig({ someOtherProp: box("value") });
+ * // childConfig still has defaultPortalTo="#some-element" from parent
+ * ```
+ */
+export function useBitsConfig(opts) {
+    return BitsConfigContext.set(new BitsConfigState(BitsConfigContext.getOr(null), opts));
+}
+/**
+ * Configuration state that inherits from parent configurations.
+ *
+ * @example
+ * Config resolution:
+ * ```
+ * Level 1: { defaultPortalTo: "#some-element", theme: "dark" }
+ * Level 2: { spacing: "large" } // inherits defaultPortalTo="#some-element", theme="dark"
+ * Level 3: { theme: "light" }   // inherits defaultPortalTo="#some-element", spacing="large", overrides theme="light"
+ * ```
+ */
+export class BitsConfigState {
+    opts;
+    constructor(parent, opts) {
+        const resolveConfigOption = createConfigResolver(parent, opts);
+        this.opts = {
+            defaultPortalTo: resolveConfigOption((config) => config.defaultPortalTo),
+            defaultLocale: resolveConfigOption((config) => config.defaultLocale),
+        };
+    }
+}
+/**
+ * Returns a config resolver that resolves a given config option's value.
+ *
+ * The resolver creates reactive boxes that resolve config option values using this priority:
+ * 1. Current level's value (if defined)
+ * 2. Parent level's value (if defined and current is undefined)
+ * 3. `undefined` (if no value is found in either parent or child)
+ *
+ * @param parent - Parent configuration state (null if this is root level)
+ * @param currentOpts - Current level's configuration options
+ *
+ * @example
+ * ```typescript
+ * // Given this hierarchy:
+ * // Root: { defaultPortalTo: "#some-element" }
+ * // Child: { someOtherProp: "value" } // no defaultPortalTo specified
+ *
+ * const resolveConfigOption = createConfigResolver(parent, opts);
+ * const portalTo = resolveConfigOption(config => config.defaultPortalTo);
+ *
+ * // portalTo.current === "#some-element" (inherited from parent)
+ * // even when child didn't specify `defaultPortalTo`
+ * ```
+ */
+function createConfigResolver(parent, currentOpts) {
+    return (getter) => {
+        const configOption = boxWith(() => {
+            // try current opts first
+            const value = getter(currentOpts)?.current;
+            if (value !== undefined)
+                return value;
+            // if no parent, return undefined
+            if (parent === null)
+                return undefined;
+            // get value from parent (which already has its own chain resolved)
+            return getter(parent.opts)?.current;
+        });
+        return configOption;
+    };
+}

web/node_modules/bits-ui/dist/bits/utilities/config/components/bits-config.svelte

@@ -0,0 +1,14 @@
+<script lang="ts">
+	import type { BitsConfigProps } from "../types.js";
+	import { useBitsConfig } from "../bits-config.js";
+	import { boxWith } from "svelte-toolbelt";
+
+	let { children, defaultPortalTo, defaultLocale }: BitsConfigProps = $props();
+
+	useBitsConfig({
+		defaultPortalTo: boxWith(() => defaultPortalTo),
+		defaultLocale: boxWith(() => defaultLocale),
+	});
+</script>
+
+{@render children?.()}

web/node_modules/bits-ui/dist/bits/utilities/config/components/bits-config.svelte.d.ts

@@ -0,0 +1,4 @@
+import type { BitsConfigProps } from "../types.js";
+declare const BitsConfig: import("svelte").Component<BitsConfigProps, {}, "">;
+type BitsConfig = ReturnType<typeof BitsConfig>;
+export default BitsConfig;

web/node_modules/bits-ui/dist/bits/utilities/config/exports.d.ts

@@ -0,0 +1,2 @@
+export { default as BitsConfig } from "./components/bits-config.svelte";
+export { getBitsConfig, BitsConfigState } from "./bits-config.js";

web/node_modules/bits-ui/dist/bits/utilities/config/exports.js

@@ -0,0 +1,2 @@
+export { default as BitsConfig } from "./components/bits-config.svelte";
+export { getBitsConfig, BitsConfigState } from "./bits-config.js";

web/node_modules/bits-ui/dist/bits/utilities/config/index.d.ts

@@ -0,0 +1 @@
+export * from "./exports.js";

web/node_modules/bits-ui/dist/bits/utilities/config/index.js

@@ -0,0 +1 @@
+export * from "./exports.js";

web/node_modules/bits-ui/dist/bits/utilities/config/prop-resolvers.d.ts

@@ -0,0 +1,13 @@
+import { type Getter, type ReadableBox } from "svelte-toolbelt";
+/**
+ * Resolves a locale value using the prop, the config default, or a fallback.
+ *
+ * Default value: `"en"`
+ */
+export declare const resolveLocaleProp: (getProp: Getter<string | undefined>) => ReadableBox<string>;
+/**
+ * Resolves a portal's `to` value using the prop, the config default, or a fallback.
+ *
+ * Default value: `"body"`
+ */
+export declare const resolvePortalToProp: (getProp: Getter<string | Element | undefined>) => ReadableBox<string | Element>;

web/node_modules/bits-ui/dist/bits/utilities/config/prop-resolvers.js

@@ -0,0 +1,37 @@
+import { boxWith } from "svelte-toolbelt";
+import { getBitsConfig } from "./bits-config.js";
+/**
+ * Creates a generic prop resolver that follows a standard priority chain:
+ * 1. The getter's prop value (if defined)
+ * 2. The config default value (if no getter prop value is defined)
+ * 3. The fallback value (if no config value found)
+ */
+function createPropResolver(configOption, fallback) {
+    return (getProp) => {
+        const config = getBitsConfig();
+        return boxWith(() => {
+            // 1. return the prop's value, if provided
+            const propValue = getProp();
+            if (propValue !== undefined)
+                return propValue;
+            // 2. return the resolved config option value, if available
+            const option = configOption(config).current;
+            if (option !== undefined)
+                return option;
+            // 3. return the fallback if no other value is found
+            return fallback;
+        });
+    };
+}
+/**
+ * Resolves a locale value using the prop, the config default, or a fallback.
+ *
+ * Default value: `"en"`
+ */
+export const resolveLocaleProp = createPropResolver((config) => config.defaultLocale, "en");
+/**
+ * Resolves a portal's `to` value using the prop, the config default, or a fallback.
+ *
+ * Default value: `"body"`
+ */
+export const resolvePortalToProp = createPropResolver((config) => config.defaultPortalTo, "body");

web/node_modules/bits-ui/dist/bits/utilities/config/types.d.ts

@@ -0,0 +1,13 @@
+import type { WithChildren } from "../../../internal/types.js";
+import type { PortalTarget } from "../portal/types.js";
+export type BitsConfigPropsWithoutChildren = {
+    /**
+     * The default portal `to`/target to use for the `Portal` components throughout the app.
+     */
+    defaultPortalTo?: PortalTarget;
+    /**
+     * The default locale to use for the components that support localization.
+     */
+    defaultLocale?: string;
+};
+export type BitsConfigProps = WithChildren<BitsConfigPropsWithoutChildren>;

web/node_modules/bits-ui/dist/bits/utilities/config/types.js

@@ -0,0 +1 @@
+export {};