feat: Phase 1 — extract the client (web SPA + desktop) to dtoro/oikos-web

Problem: the hexagonal refactor churns the backend tree for nine more
phases; the UI delivery stack (web/ SPA, cmd/desktop Wails wrapper,
compose/web image) must move to its own repo first so doc/layout
rewrites land once on a backend-only tree.

Change:
- New repo git.hubris.network/dtoro/oikos-web (v0.33.0): web/, desktop/
  (updateURL repointed to oikos-web releases), compose/, own CI (web +
  desktop jobs), own deploy script (CI-green gate, TOCTOU guard,
  version-tagged images, prune-to-3), own webhook receiver on :9798 +
  launchd unit, own compose project publishing the same 8091:80.
- Cutover executed on mac-mini in order: oikos stack's web service
  stopped+removed, oikos-web project brought up on 8091; outer Caddy
  untouched (targets the published port) — serving + Authentik flow +
  /wails 404 quirk verified post-cutover.
- Stripped from oikos: web/, cmd/desktop/, compose/web/, desktop CI
  workflow, ci.yml web job, Makefile ui/desktop/desktop-package/install
  targets, the compose web service, oikos-web from deploy.sh's fallback
  prune list; wails + go-keyring dropped from go.mod, vendor synced.
- README / CONTRIBUTING / AGENTS.md / .agents dev+operations docs now
  point at the new repo; mbse + mascot design docs carry a path note.

Risk: production SPA serving depends on the new pipeline now; rollback
is versioned-image re-up of the old web service from a pre-split
checkout (port 8091). Desktop builds installed before the split still
check dtoro/oikos releases — one manual reinstall, noted in the
oikos-web release notes.

Verification: go vet, make test (race), make generate-check, golangci
(no new findings; baseline down 400→365); post-cutover curls —
localhost:8091 200, /wails/runtime.js 404, outer Caddy 302 Authentik.

web/node_modules/check-error/README.md

@@ -0,0 +1,144 @@
+<h1 align=center>
+  <a href="http://chaijs.com" title="Chai Documentation">
+    <img alt="ChaiJS" src="http://chaijs.com/img/chai-logo.png">
+  </a>
+  <br>
+  check-error
+</h1>
+
+<p align=center>
+  Error comparison and information related utility for <a href="http://nodejs.org">node</a> and the browser.
+</p>
+
+## What is Check-Error?
+
+Check-Error is a module which you can use to retrieve an Error's information such as its `message` or `constructor` name and also to check whether two Errors are compatible based on their messages, constructors or even instances.
+
+## Installation
+
+### Node.js
+
+`check-error` is available on [npm](http://npmjs.org). To install it, type:
+
+    $ npm install check-error
+
+### Browsers
+
+You can also use it within the browser; install via npm and use the `check-error.js` file found within the download. For example:
+
+```html
+<script src="./node_modules/check-error/check-error.js"></script>
+```
+
+## Usage
+
+The primary export of `check-error` is an object which has the following methods:
+
+* `compatibleInstance(err, errorLike)` - Checks if an error is compatible with another `errorLike` object. If `errorLike` is an error instance we do a strict comparison, otherwise we return `false` by default, because instances of objects can only be compatible if they're both error instances.
+* `compatibleConstructor(err, errorLike)` - Checks if an error's constructor is compatible with another `errorLike` object. If `err` has the same constructor as `errorLike` or if `err` is an instance of `errorLike`.
+* `compatibleMessage(err, errMatcher)` - Checks if an error message is compatible with an `errMatcher` RegExp or String (we check if the message contains the String).
+* `getConstructorName(errorLike)` - Retrieves the name of a constructor, an error's constructor or `errorLike` itself if it's not an error instance or constructor.
+* `getMessage(err)` - Retrieves the message of an error or `err` itself if it's a String. If `err` or `err.message` is undefined we return an empty String.
+
+```js
+import * as checkError 'check-error';
+```
+
+#### .compatibleInstance(err, errorLike)
+
+```js
+import * as checkError 'check-error';
+
+const funcThatThrows = function() { throw new TypeError('I am a TypeError') };
+let caughtErr;
+
+try {
+  funcThatThrows();
+} catch(e) {
+  caughtErr = e;
+}
+
+const sameInstance = caughtErr;
+
+checkError.compatibleInstance(caughtErr, sameInstance); // true
+checkError.compatibleInstance(caughtErr, new TypeError('Another error')); // false
+```
+
+#### .compatibleConstructor(err, errorLike)
+
+```js
+import * as checkError 'check-error';
+
+const funcThatThrows = function() { throw new TypeError('I am a TypeError') };
+let caughtErr;
+
+try {
+  funcThatThrows();
+} catch(e) {
+  caughtErr = e;
+}
+
+checkError.compatibleConstructor(caughtErr, Error); // true
+checkError.compatibleConstructor(caughtErr, TypeError); // true
+checkError.compatibleConstructor(caughtErr, RangeError); // false
+```
+
+#### .compatibleMessage(err, errMatcher)
+
+```js
+import * as checkError 'check-error';
+
+const funcThatThrows = function() { throw new TypeError('I am a TypeError') };
+let caughtErr;
+
+try {
+  funcThatThrows();
+} catch(e) {
+  caughtErr = e;
+}
+
+const sameInstance = caughtErr;
+
+checkError.compatibleMessage(caughtErr, /TypeError$/); // true
+checkError.compatibleMessage(caughtErr, 'I am a'); // true
+checkError.compatibleMessage(caughtErr, /unicorn/); // false
+checkError.compatibleMessage(caughtErr, 'I do not exist'); // false
+```
+
+#### .getConstructorName(errorLike)
+
+```js
+import * as checkError 'check-error';
+
+const funcThatThrows = function() { throw new TypeError('I am a TypeError') };
+let caughtErr;
+
+try {
+  funcThatThrows();
+} catch(e) {
+  caughtErr = e;
+}
+
+const sameInstance = caughtErr;
+
+checkError.getConstructorName(caughtErr) // 'TypeError'
+```
+
+#### .getMessage(err)
+
+```js
+import * as checkError 'check-error';
+
+const funcThatThrows = function() { throw new TypeError('I am a TypeError') };
+let caughtErr;
+
+try {
+  funcThatThrows();
+} catch(e) {
+  caughtErr = e;
+}
+
+const sameInstance = caughtErr;
+
+checkError.getMessage(caughtErr) // 'I am a TypeError'
+```