feat: Phase 1 — extract the client (web SPA + desktop) to dtoro/oikos-web

Problem: the hexagonal refactor churns the backend tree for nine more
phases; the UI delivery stack (web/ SPA, cmd/desktop Wails wrapper,
compose/web image) must move to its own repo first so doc/layout
rewrites land once on a backend-only tree.

Change:
- New repo git.hubris.network/dtoro/oikos-web (v0.33.0): web/, desktop/
  (updateURL repointed to oikos-web releases), compose/, own CI (web +
  desktop jobs), own deploy script (CI-green gate, TOCTOU guard,
  version-tagged images, prune-to-3), own webhook receiver on :9798 +
  launchd unit, own compose project publishing the same 8091:80.
- Cutover executed on mac-mini in order: oikos stack's web service
  stopped+removed, oikos-web project brought up on 8091; outer Caddy
  untouched (targets the published port) — serving + Authentik flow +
  /wails 404 quirk verified post-cutover.
- Stripped from oikos: web/, cmd/desktop/, compose/web/, desktop CI
  workflow, ci.yml web job, Makefile ui/desktop/desktop-package/install
  targets, the compose web service, oikos-web from deploy.sh's fallback
  prune list; wails + go-keyring dropped from go.mod, vendor synced.
- README / CONTRIBUTING / AGENTS.md / .agents dev+operations docs now
  point at the new repo; mbse + mascot design docs carry a path note.

Risk: production SPA serving depends on the new pipeline now; rollback
is versioned-image re-up of the old web service from a pre-split
checkout (port 8091). Desktop builds installed before the split still
check dtoro/oikos releases — one manual reinstall, noted in the
oikos-web release notes.

Verification: go vet, make test (race), make generate-check, golangci
(no new findings; baseline down 400→365); post-cutover curls —
localhost:8091 200, /wails/runtime.js 404, outer Caddy 302 Authentik.

web/node_modules/bits-ui/dist/bits/utilities/escape-layer/escape-layer.svelte

@@ -0,0 +1,23 @@
+<script lang="ts">
+	import { boxWith } from "svelte-toolbelt";
+	import type { EscapeLayerImplProps } from "./types.js";
+	import { EscapeLayerState } from "./use-escape-layer.svelte.js";
+	import { noop } from "../../../internal/noop.js";
+
+	let {
+		escapeKeydownBehavior = "close",
+		onEscapeKeydown = noop,
+		children,
+		enabled,
+		ref,
+	}: EscapeLayerImplProps = $props();
+
+	EscapeLayerState.create({
+		escapeKeydownBehavior: boxWith(() => escapeKeydownBehavior),
+		onEscapeKeydown: boxWith(() => onEscapeKeydown),
+		enabled: boxWith(() => enabled),
+		ref,
+	});
+</script>
+
+{@render children?.()}

web/node_modules/bits-ui/dist/bits/utilities/escape-layer/escape-layer.svelte.d.ts

@@ -0,0 +1,4 @@
+import type { EscapeLayerImplProps } from "./types.js";
+declare const EscapeLayer: import("svelte").Component<EscapeLayerImplProps, {}, "">;
+type EscapeLayer = ReturnType<typeof EscapeLayer>;
+export default EscapeLayer;

web/node_modules/bits-ui/dist/bits/utilities/escape-layer/index.d.ts

@@ -0,0 +1,2 @@
+export { default as EscapeLayer } from "./escape-layer.svelte";
+export type { EscapeLayerProps } from "./types.js";

web/node_modules/bits-ui/dist/bits/utilities/escape-layer/index.js

@@ -0,0 +1 @@
+export { default as EscapeLayer } from "./escape-layer.svelte";

web/node_modules/bits-ui/dist/bits/utilities/escape-layer/types.d.ts

@@ -0,0 +1,29 @@
+import type { Snippet } from "svelte";
+import type { Box } from "svelte-toolbelt";
+export type EscapeBehaviorType = "close" | "defer-otherwise-close" | "defer-otherwise-ignore" | "ignore";
+export type EscapeLayerProps = {
+    /**
+     * Callback fired when escape is pressed.
+     */
+    onEscapeKeydown?: (e: KeyboardEvent) => void;
+    /**
+     * Escape behavior type.
+     * `close`: Closes the element immediately.
+     * `defer-otherwise-close`: Delegates the action to its parent component that has an
+     * escape keydown handler. If no parent is found, it closes the element.
+     * `defer-otherwise-ignore`: Delegates the action to the parent element. If no parent is found, nothing is done.
+     * `ignore`: Prevents the element from closing and also blocks the parent element from closing in response to an escape key press.
+     *
+     * @defaultValue `close`
+     */
+    escapeKeydownBehavior?: EscapeBehaviorType;
+};
+export type EscapeLayerImplProps = {
+    /**
+     * Whether the layer is enabled. Currently, we determine this with the
+     * `presence` returned from the `presence` layer.
+     */
+    enabled: boolean;
+    children?: Snippet;
+    ref: Box<HTMLElement | null>;
+} & EscapeLayerProps;

web/node_modules/bits-ui/dist/bits/utilities/escape-layer/types.js

@@ -0,0 +1 @@
+export {};

web/node_modules/bits-ui/dist/bits/utilities/escape-layer/use-escape-layer.svelte.d.ts

@@ -0,0 +1,13 @@
+import { DOMContext, type Box, type ReadableBoxedValues } from "svelte-toolbelt";
+import type { EscapeLayerImplProps } from "./types.js";
+interface EscapeLayerStateOpts extends ReadableBoxedValues<Required<Omit<EscapeLayerImplProps, "children" | "ref">>> {
+    ref: Box<HTMLElement | null>;
+}
+export declare class EscapeLayerState {
+    #private;
+    static create(opts: EscapeLayerStateOpts): EscapeLayerState;
+    readonly opts: EscapeLayerStateOpts;
+    readonly domContext: DOMContext;
+    constructor(opts: EscapeLayerStateOpts);
+}
+export {};

web/node_modules/bits-ui/dist/bits/utilities/escape-layer/use-escape-layer.svelte.js

@@ -0,0 +1,55 @@
+import { DOMContext } from "svelte-toolbelt";
+import { watch } from "runed";
+import { on } from "svelte/events";
+import { kbd } from "../../../internal/kbd.js";
+import { noop } from "../../../internal/noop.js";
+globalThis.bitsEscapeLayers ??= new Map();
+export class EscapeLayerState {
+    static create(opts) {
+        return new EscapeLayerState(opts);
+    }
+    opts;
+    domContext;
+    constructor(opts) {
+        this.opts = opts;
+        this.domContext = new DOMContext(this.opts.ref);
+        let unsubEvents = noop;
+        watch(() => opts.enabled.current, (enabled) => {
+            if (enabled) {
+                globalThis.bitsEscapeLayers.set(this, opts.escapeKeydownBehavior);
+                unsubEvents = this.#addEventListener();
+            }
+            return () => {
+                unsubEvents();
+                globalThis.bitsEscapeLayers.delete(this);
+            };
+        });
+    }
+    #addEventListener = () => {
+        return on(this.domContext.getDocument(), "keydown", this.#onkeydown, { passive: false });
+    };
+    #onkeydown = (e) => {
+        if (e.key !== kbd.ESCAPE || !isResponsibleEscapeLayer(this))
+            return;
+        const clonedEvent = new KeyboardEvent(e.type, e);
+        e.preventDefault();
+        const behaviorType = this.opts.escapeKeydownBehavior.current;
+        if (behaviorType !== "close" && behaviorType !== "defer-otherwise-close")
+            return;
+        this.opts.onEscapeKeydown.current(clonedEvent);
+    };
+}
+function isResponsibleEscapeLayer(instance) {
+    const layersArr = [...globalThis.bitsEscapeLayers];
+    /**
+     * We first check if we can find a top layer with `close` or `ignore`.
+     * If that top layer was found and matches the provided node, then the node is
+     * responsible for the escape. Otherwise, we know that all layers defer so
+     * the first layer is the responsible one.
+     */
+    const topMostLayer = layersArr.findLast(([_, { current: behaviorType }]) => behaviorType === "close" || behaviorType === "ignore");
+    if (topMostLayer)
+        return topMostLayer[0] === instance;
+    const [firstLayerNode] = layersArr[0];
+    return firstLayerNode === instance;
+}