feat: Phase 1 — extract the client (web SPA + desktop) to dtoro/oikos-web

Problem: the hexagonal refactor churns the backend tree for nine more
phases; the UI delivery stack (web/ SPA, cmd/desktop Wails wrapper,
compose/web image) must move to its own repo first so doc/layout
rewrites land once on a backend-only tree.

Change:
- New repo git.hubris.network/dtoro/oikos-web (v0.33.0): web/, desktop/
  (updateURL repointed to oikos-web releases), compose/, own CI (web +
  desktop jobs), own deploy script (CI-green gate, TOCTOU guard,
  version-tagged images, prune-to-3), own webhook receiver on :9798 +
  launchd unit, own compose project publishing the same 8091:80.
- Cutover executed on mac-mini in order: oikos stack's web service
  stopped+removed, oikos-web project brought up on 8091; outer Caddy
  untouched (targets the published port) — serving + Authentik flow +
  /wails 404 quirk verified post-cutover.
- Stripped from oikos: web/, cmd/desktop/, compose/web/, desktop CI
  workflow, ci.yml web job, Makefile ui/desktop/desktop-package/install
  targets, the compose web service, oikos-web from deploy.sh's fallback
  prune list; wails + go-keyring dropped from go.mod, vendor synced.
- README / CONTRIBUTING / AGENTS.md / .agents dev+operations docs now
  point at the new repo; mbse + mascot design docs carry a path note.

Risk: production SPA serving depends on the new pipeline now; rollback
is versioned-image re-up of the old web service from a pre-split
checkout (port 8091). Desktop builds installed before the split still
check dtoro/oikos releases — one manual reinstall, noted in the
oikos-web release notes.

Verification: go vet, make test (race), make generate-check, golangci
(no new findings; baseline down 400→365); post-cutover curls —
localhost:8091 200, /wails/runtime.js 404, outer Caddy 302 Authentik.

web/node_modules/bits-ui/dist/internal/tabbable.js

@@ -0,0 +1,51 @@
+import { focusable, isFocusable, isTabbable, tabbable } from "tabbable";
+import { getDocument } from "svelte-toolbelt";
+function getTabbableOptions() {
+    return {
+        getShadowRoot: true,
+        displayCheck: 
+        // JSDOM does not support the `tabbable` library. To solve this we can
+        // check if `ResizeObserver` is a real function (not polyfilled), which
+        // determines if the current environment is JSDOM-like.
+        typeof ResizeObserver === "function" &&
+            ResizeObserver.toString().includes("[native code]")
+            ? "full"
+            : "none",
+    };
+}
+/**
+ * Gets all tabbable elements in the body and finds the next/previous tabbable element
+ * from the `currentNode` based on the `direction` provided.
+ * @param currentNode - the node we want to get the next/previous tabbable from
+ */
+export function getTabbableFrom(currentNode, direction) {
+    if (!isTabbable(currentNode, getTabbableOptions())) {
+        return getTabbableFromFocusable(currentNode, direction);
+    }
+    const doc = getDocument(currentNode);
+    const allTabbable = tabbable(doc.body, getTabbableOptions());
+    if (direction === "prev")
+        allTabbable.reverse();
+    const activeIndex = allTabbable.indexOf(currentNode);
+    if (activeIndex === -1)
+        return doc.body;
+    const nextTabbableElements = allTabbable.slice(activeIndex + 1);
+    return nextTabbableElements[0];
+}
+export function getTabbableFromFocusable(currentNode, direction) {
+    const doc = getDocument(currentNode);
+    if (!isFocusable(currentNode, getTabbableOptions()))
+        return doc.body;
+    // find all focusable nodes, since some elements may be focusable but not tabbable
+    // such as context menu triggers
+    const allFocusable = focusable(doc.body, getTabbableOptions());
+    // find index of current node among focusable siblings
+    if (direction === "prev")
+        allFocusable.reverse();
+    const activeIndex = allFocusable.indexOf(currentNode);
+    if (activeIndex === -1)
+        return doc.body;
+    const nextFocusableElements = allFocusable.slice(activeIndex + 1);
+    // find the next focusable node that is also tabbable
+    return nextFocusableElements.find((node) => isTabbable(node, getTabbableOptions())) ?? doc.body;
+}