feat: Phase 1 — extract the client (web SPA + desktop) to dtoro/oikos-web

Problem: the hexagonal refactor churns the backend tree for nine more
phases; the UI delivery stack (web/ SPA, cmd/desktop Wails wrapper,
compose/web image) must move to its own repo first so doc/layout
rewrites land once on a backend-only tree.

Change:
- New repo git.hubris.network/dtoro/oikos-web (v0.33.0): web/, desktop/
  (updateURL repointed to oikos-web releases), compose/, own CI (web +
  desktop jobs), own deploy script (CI-green gate, TOCTOU guard,
  version-tagged images, prune-to-3), own webhook receiver on :9798 +
  launchd unit, own compose project publishing the same 8091:80.
- Cutover executed on mac-mini in order: oikos stack's web service
  stopped+removed, oikos-web project brought up on 8091; outer Caddy
  untouched (targets the published port) — serving + Authentik flow +
  /wails 404 quirk verified post-cutover.
- Stripped from oikos: web/, cmd/desktop/, compose/web/, desktop CI
  workflow, ci.yml web job, Makefile ui/desktop/desktop-package/install
  targets, the compose web service, oikos-web from deploy.sh's fallback
  prune list; wails + go-keyring dropped from go.mod, vendor synced.
- README / CONTRIBUTING / AGENTS.md / .agents dev+operations docs now
  point at the new repo; mbse + mascot design docs carry a path note.

Risk: production SPA serving depends on the new pipeline now; rollback
is versioned-image re-up of the old web service from a pre-split
checkout (port 8091). Desktop builds installed before the split still
check dtoro/oikos releases — one manual reinstall, noted in the
oikos-web release notes.

Verification: go vet, make test (race), make generate-check, golangci
(no new findings; baseline down 400→365); post-cutover curls —
localhost:8091 200, /wails/runtime.js 404, outer Caddy 302 Authentik.

web/node_modules/cssstyle/lib/allWebkitProperties.js

@@ -0,0 +1,114 @@
+"use strict";
+
+/**
+ * This file contains all implemented properties that are not a part of any
+ * current specifications or drafts, but are handled by browsers nevertheless.
+ */
+
+module.exports = [
+  "background-composite",
+  "border-after",
+  "border-after-color",
+  "border-after-style",
+  "border-after-width",
+  "border-before",
+  "border-before-color",
+  "border-before-style",
+  "border-before-width",
+  "border-end",
+  "border-end-color",
+  "border-end-style",
+  "border-end-width",
+  "border-fit",
+  "border-horizontal-spacing",
+  "border-start",
+  "border-start-color",
+  "border-start-style",
+  "border-start-width",
+  "border-vertical-spacing",
+  "color-correction",
+  "column-axis",
+  "column-break-after",
+  "column-break-before",
+  "column-break-inside",
+  "column-rule-color",
+  "flex-align",
+  "flex-item-align",
+  "flex-line-pack",
+  "flex-order",
+  "flex-pack",
+  "flex-wrap",
+  "font-size-delta",
+  "font-smoothing",
+  "highlight",
+  "hyphenate-limit-after",
+  "hyphenate-limit-before",
+  "locale",
+  "logical-height",
+  "logical-width",
+  "margin-after",
+  "margin-after-collapse",
+  "margin-before",
+  "margin-before-collapse",
+  "margin-bottom-collapse",
+  "margin-collapse",
+  "margin-end",
+  "margin-start",
+  "margin-top-collapse",
+  "marquee",
+  "marquee-direction",
+  "marquee-increment",
+  "marquee-repetition",
+  "marquee-speed",
+  "marquee-style",
+  "mask-attachment",
+  "mask-box-image-outset",
+  "mask-box-image-repeat",
+  "mask-box-image-slice",
+  "mask-box-image-source",
+  "mask-box-image-width",
+  "mask-position-x",
+  "mask-position-y",
+  "mask-repeat-x",
+  "mask-repeat-y",
+  "match-nearest-mail-blockquote-color",
+  "max-logical-height",
+  "max-logical-width",
+  "min-logical-height",
+  "min-logical-width",
+  "nbsp-mode",
+  "overflow-scrolling",
+  "padding-after",
+  "padding-before",
+  "padding-end",
+  "padding-start",
+  "perspective-origin-x",
+  "perspective-origin-y",
+  "region-break-after",
+  "region-break-before",
+  "region-break-inside",
+  "region-overflow",
+  "rtl-ordering",
+  "svg-shadow",
+  "tap-highlight-color",
+  "text-decorations-in-effect",
+  "text-emphasis-color",
+  "text-fill-color",
+  "text-security",
+  "text-size-adjust",
+  "text-stroke",
+  "text-stroke-color",
+  "text-stroke-width",
+  "transform",
+  "transform-origin-x",
+  "transform-origin-y",
+  "transform-origin-z",
+  "user-drag",
+  "user-modify",
+  "wrap",
+  "wrap-margin",
+  "wrap-padding",
+  "wrap-shape-inside",
+  "wrap-shape-outside",
+  "zoom"
+].map((prop) => `-webkit-${prop}`);