feat: Phase 1 — extract the client (web SPA + desktop) to dtoro/oikos-web

Problem: the hexagonal refactor churns the backend tree for nine more
phases; the UI delivery stack (web/ SPA, cmd/desktop Wails wrapper,
compose/web image) must move to its own repo first so doc/layout
rewrites land once on a backend-only tree.

Change:
- New repo git.hubris.network/dtoro/oikos-web (v0.33.0): web/, desktop/
  (updateURL repointed to oikos-web releases), compose/, own CI (web +
  desktop jobs), own deploy script (CI-green gate, TOCTOU guard,
  version-tagged images, prune-to-3), own webhook receiver on :9798 +
  launchd unit, own compose project publishing the same 8091:80.
- Cutover executed on mac-mini in order: oikos stack's web service
  stopped+removed, oikos-web project brought up on 8091; outer Caddy
  untouched (targets the published port) — serving + Authentik flow +
  /wails 404 quirk verified post-cutover.
- Stripped from oikos: web/, cmd/desktop/, compose/web/, desktop CI
  workflow, ci.yml web job, Makefile ui/desktop/desktop-package/install
  targets, the compose web service, oikos-web from deploy.sh's fallback
  prune list; wails + go-keyring dropped from go.mod, vendor synced.
- README / CONTRIBUTING / AGENTS.md / .agents dev+operations docs now
  point at the new repo; mbse + mascot design docs carry a path note.

Risk: production SPA serving depends on the new pipeline now; rollback
is versioned-image re-up of the old web service from a pre-split
checkout (port 8091). Desktop builds installed before the split still
check dtoro/oikos releases — one manual reinstall, noted in the
oikos-web release notes.

Verification: go vet, make test (race), make generate-check, golangci
(no new findings; baseline down 400→365); post-cutover curls —
localhost:8091 200, /wails/runtime.js 404, outer Caddy 302 Authentik.

web/node_modules/eslint/lib/rules/no-dupe-else-if.js

@@ -0,0 +1,145 @@
+/**
+ * @fileoverview Rule to disallow duplicate conditions in if-else-if chains
+ * @author Milos Djermanovic
+ */
+
+"use strict";
+
+//------------------------------------------------------------------------------
+// Requirements
+//------------------------------------------------------------------------------
+
+const astUtils = require("./utils/ast-utils");
+
+//------------------------------------------------------------------------------
+// Helpers
+//------------------------------------------------------------------------------
+
+/**
+ * Determines whether the first given array is a subset of the second given array.
+ * @param {Function} comparator A function to compare two elements, should return `true` if they are equal.
+ * @param {Array} arrA The array to compare from.
+ * @param {Array} arrB The array to compare against.
+ * @returns {boolean} `true` if the array `arrA` is a subset of the array `arrB`.
+ */
+function isSubsetByComparator(comparator, arrA, arrB) {
+	return arrA.every(a => arrB.some(b => comparator(a, b)));
+}
+
+/**
+ * Splits the given node by the given logical operator.
+ * @param {string} operator Logical operator `||` or `&&`.
+ * @param {ASTNode} node The node to split.
+ * @returns {ASTNode[]} Array of conditions that makes the node when joined by the operator.
+ */
+function splitByLogicalOperator(operator, node) {
+	if (node.type === "LogicalExpression" && node.operator === operator) {
+		return [
+			...splitByLogicalOperator(operator, node.left),
+			...splitByLogicalOperator(operator, node.right),
+		];
+	}
+	return [node];
+}
+
+const splitByOr = splitByLogicalOperator.bind(null, "||");
+const splitByAnd = splitByLogicalOperator.bind(null, "&&");
+
+//------------------------------------------------------------------------------
+// Rule Definition
+//------------------------------------------------------------------------------
+
+/** @type {import('../types').Rule.RuleModule} */
+module.exports = {
+	meta: {
+		type: "problem",
+
+		docs: {
+			description: "Disallow duplicate conditions in if-else-if chains",
+			recommended: true,
+			url: "https://eslint.org/docs/latest/rules/no-dupe-else-if",
+		},
+
+		schema: [],
+
+		messages: {
+			unexpected:
+				"This branch can never execute. Its condition is a duplicate or covered by previous conditions in the if-else-if chain.",
+		},
+	},
+
+	create(context) {
+		const sourceCode = context.sourceCode;
+
+		/**
+		 * Determines whether the two given nodes are considered to be equal. In particular, given that the nodes
+		 * represent expressions in a boolean context, `||` and `&&` can be considered as commutative operators.
+		 * @param {ASTNode} a First node.
+		 * @param {ASTNode} b Second node.
+		 * @returns {boolean} `true` if the nodes are considered to be equal.
+		 */
+		function equal(a, b) {
+			if (a.type !== b.type) {
+				return false;
+			}
+
+			if (
+				a.type === "LogicalExpression" &&
+				(a.operator === "||" || a.operator === "&&") &&
+				a.operator === b.operator
+			) {
+				return (
+					(equal(a.left, b.left) && equal(a.right, b.right)) ||
+					(equal(a.left, b.right) && equal(a.right, b.left))
+				);
+			}
+
+			return astUtils.equalTokens(a, b, sourceCode);
+		}
+
+		const isSubset = isSubsetByComparator.bind(null, equal);
+
+		return {
+			IfStatement(node) {
+				const test = node.test,
+					conditionsToCheck =
+						test.type === "LogicalExpression" &&
+						test.operator === "&&"
+							? [test, ...splitByAnd(test)]
+							: [test];
+				let current = node,
+					listToCheck = conditionsToCheck.map(c =>
+						splitByOr(c).map(splitByAnd),
+					);
+
+				while (
+					current.parent &&
+					current.parent.type === "IfStatement" &&
+					current.parent.alternate === current
+				) {
+					current = current.parent;
+
+					const currentOrOperands = splitByOr(current.test).map(
+						splitByAnd,
+					);
+
+					listToCheck = listToCheck.map(orOperands =>
+						orOperands.filter(
+							orOperand =>
+								!currentOrOperands.some(currentOrOperand =>
+									isSubset(currentOrOperand, orOperand),
+								),
+						),
+					);
+
+					if (
+						listToCheck.some(orOperands => orOperands.length === 0)
+					) {
+						context.report({ node: test, messageId: "unexpected" });
+						break;
+					}
+				}
+			},
+		};
+	},
+};