feat: Phase 1 — extract the client (web SPA + desktop) to dtoro/oikos-web

Problem: the hexagonal refactor churns the backend tree for nine more
phases; the UI delivery stack (web/ SPA, cmd/desktop Wails wrapper,
compose/web image) must move to its own repo first so doc/layout
rewrites land once on a backend-only tree.

Change:
- New repo git.hubris.network/dtoro/oikos-web (v0.33.0): web/, desktop/
  (updateURL repointed to oikos-web releases), compose/, own CI (web +
  desktop jobs), own deploy script (CI-green gate, TOCTOU guard,
  version-tagged images, prune-to-3), own webhook receiver on :9798 +
  launchd unit, own compose project publishing the same 8091:80.
- Cutover executed on mac-mini in order: oikos stack's web service
  stopped+removed, oikos-web project brought up on 8091; outer Caddy
  untouched (targets the published port) — serving + Authentik flow +
  /wails 404 quirk verified post-cutover.
- Stripped from oikos: web/, cmd/desktop/, compose/web/, desktop CI
  workflow, ci.yml web job, Makefile ui/desktop/desktop-package/install
  targets, the compose web service, oikos-web from deploy.sh's fallback
  prune list; wails + go-keyring dropped from go.mod, vendor synced.
- README / CONTRIBUTING / AGENTS.md / .agents dev+operations docs now
  point at the new repo; mbse + mascot design docs carry a path note.

Risk: production SPA serving depends on the new pipeline now; rollback
is versioned-image re-up of the old web service from a pre-split
checkout (port 8091). Desktop builds installed before the split still
check dtoro/oikos releases — one manual reinstall, noted in the
oikos-web release notes.

Verification: go vet, make test (race), make generate-check, golangci
(no new findings; baseline down 400→365); post-cutover curls —
localhost:8091 200, /wails/runtime.js 404, outer Caddy 302 Authentik.

web/node_modules/enhanced-resolve/lib/ModulesUtils.js

@@ -0,0 +1,132 @@
+/*
+	MIT License http://www.opensource.org/licenses/mit-license.php
+	Author Tobias Koppers @sokra
+*/
+
+"use strict";
+
+const forEachBail = require("./forEachBail");
+const { getPathsCached } = require("./getPaths");
+
+/** @typedef {import("./Resolver")} Resolver */
+/** @typedef {import("./Resolver").ResolveRequest} ResolveRequest */
+/** @typedef {import("./Resolver").ResolveStepHook} ResolveStepHook */
+/** @typedef {import("./Resolver").ResolveContext} ResolveContext */
+/** @typedef {(err?: null | Error, result?: null | ResolveRequest) => void} InnerCallback */
+
+/**
+ * Per-(directories-array) cache of the flat `addrs` list produced for a given
+ * `request.path`. For a fixed directories configuration the fan-out of
+ * `ancestor × directory` is deterministic per request.path, and many resolves
+ * share the same starting directory (sibling files in one project, loops over
+ * a batch of imports, etc.) — caching avoids the `getPaths` regex split plus
+ * `len(paths) × len(directories)` join calls per resolve.
+ *
+ * The outer map is keyed on the directories array reference (plugin-owned,
+ * stable for the lifetime of the resolver), and the inner map on the
+ * starting `request.path`. Kept private to this module (rather than hung off
+ * `resolver.pathCache`) so the pathCache's hidden-class shape is unchanged —
+ * that avoids perturbing the interpreter-mode IC state for the
+ * `resolver.pathCache.{join,dirname,basename}.fn(...)` accesses that run on
+ * every resolve, which the CodSpeed instruction-count harness is sensitive to.
+ * @type {WeakMap<string[], Map<string, string[]>>}
+ */
+const _addrsCacheByDirs = new WeakMap();
+
+/**
+ * @param {Resolver} resolver resolver
+ * @param {string[]} directories directories
+ * @param {ResolveStepHook} target target
+ * @param {ResolveRequest} request request
+ * @param {ResolveContext} resolveContext resolve context
+ * @param {InnerCallback} callback callback
+ * @returns {void}
+ */
+function modulesResolveHandler(
+	resolver,
+	directories,
+	target,
+	request,
+	resolveContext,
+	callback,
+) {
+	const fs = resolver.fileSystem;
+	const requestPath = /** @type {string} */ (request.path);
+	// Compute-or-reuse the flat `addrs` list. Inlined (rather than a helper
+	// function) so the cache-hit path — which is the vast majority of
+	// invocations — stays a single WeakMap + Map lookup with no function-call
+	// overhead. See `_addrsCacheByDirs` above for caching rationale.
+	let addrs;
+	let perPath = _addrsCacheByDirs.get(directories);
+	if (perPath === undefined) {
+		perPath = new Map();
+		_addrsCacheByDirs.set(directories, perPath);
+	} else {
+		addrs = perPath.get(requestPath);
+	}
+	if (addrs === undefined) {
+		const { paths } = getPathsCached(fs, requestPath);
+		const pathsLen = paths.length;
+		const dirsLen = directories.length;
+		// Pre-size the flat array rather than going through `map().reduce()`
+		// with intermediate arrays + spreads.
+		// eslint-disable-next-line unicorn/no-new-array
+		addrs = new Array(pathsLen * dirsLen);
+		let idx = 0;
+		const joinFn = resolver.pathCache.join.fn;
+		for (let pi = 0; pi < pathsLen; pi++) {
+			const pathItem = paths[pi];
+			for (let di = 0; di < dirsLen; di++) {
+				addrs[idx++] = joinFn(pathItem, directories[di]);
+			}
+		}
+		perPath.set(requestPath, addrs);
+	}
+	// Hoist the dot-prefixed request out of the per-addr iterator. `addrs`
+	// can have up to `paths.length × directories.length` entries (e.g. 36
+	// for an 8-deep source dir × 4-module config), and concatenating the
+	// same `./${request.request}` string on every iteration is wasted
+	// work — it's constant for the whole fan-out.
+	const relRequest = `./${request.request}`;
+	forEachBail(
+		addrs,
+		/**
+		 * @param {string} addr addr
+		 * @param {(err?: null | Error, result?: null | ResolveRequest) => void} callback callback
+		 * @returns {void}
+		 */
+		(addr, callback) => {
+			fs.stat(addr, (err, stat) => {
+				if (!err && stat && stat.isDirectory()) {
+					/** @type {ResolveRequest} */
+					const obj = {
+						...request,
+						path: addr,
+						request: relRequest,
+						module: false,
+					};
+					const message = `looking for modules in ${addr}`;
+					return resolver.doResolve(
+						target,
+						obj,
+						message,
+						resolveContext,
+						callback,
+					);
+				}
+				if (resolveContext.log) {
+					resolveContext.log(`${addr} doesn't exist or is not a directory`);
+				}
+				if (resolveContext.missingDependencies) {
+					resolveContext.missingDependencies.add(addr);
+				}
+				return callback();
+			});
+		},
+		callback,
+	);
+}
+
+module.exports = {
+	modulesResolveHandler,
+};