feat: Phase 1 — extract the client (web SPA + desktop) to dtoro/oikos-web

Problem: the hexagonal refactor churns the backend tree for nine more
phases; the UI delivery stack (web/ SPA, cmd/desktop Wails wrapper,
compose/web image) must move to its own repo first so doc/layout
rewrites land once on a backend-only tree.

Change:
- New repo git.hubris.network/dtoro/oikos-web (v0.33.0): web/, desktop/
  (updateURL repointed to oikos-web releases), compose/, own CI (web +
  desktop jobs), own deploy script (CI-green gate, TOCTOU guard,
  version-tagged images, prune-to-3), own webhook receiver on :9798 +
  launchd unit, own compose project publishing the same 8091:80.
- Cutover executed on mac-mini in order: oikos stack's web service
  stopped+removed, oikos-web project brought up on 8091; outer Caddy
  untouched (targets the published port) — serving + Authentik flow +
  /wails 404 quirk verified post-cutover.
- Stripped from oikos: web/, cmd/desktop/, compose/web/, desktop CI
  workflow, ci.yml web job, Makefile ui/desktop/desktop-package/install
  targets, the compose web service, oikos-web from deploy.sh's fallback
  prune list; wails + go-keyring dropped from go.mod, vendor synced.
- README / CONTRIBUTING / AGENTS.md / .agents dev+operations docs now
  point at the new repo; mbse + mascot design docs carry a path note.

Risk: production SPA serving depends on the new pipeline now; rollback
is versioned-image re-up of the old web service from a pre-split
checkout (port 8091). Desktop builds installed before the split still
check dtoro/oikos releases — one manual reinstall, noted in the
oikos-web release notes.

Verification: go vet, make test (race), make generate-check, golangci
(no new findings; baseline down 400→365); post-cutover curls —
localhost:8091 200, /wails/runtime.js 404, outer Caddy 302 Authentik.

web/node_modules/eslint/lib/rules/prefer-named-capture-group.js

@@ -0,0 +1,197 @@
+/**
+ * @fileoverview Rule to enforce requiring named capture groups in regular expression.
+ * @author Pig Fang <https://github.com/g-plane>
+ */
+
+"use strict";
+
+//------------------------------------------------------------------------------
+// Requirements
+//------------------------------------------------------------------------------
+
+const {
+	CALL,
+	CONSTRUCT,
+	ReferenceTracker,
+	getStringIfConstant,
+} = require("@eslint-community/eslint-utils");
+const regexpp = require("@eslint-community/regexpp");
+
+//------------------------------------------------------------------------------
+// Typedefs
+//------------------------------------------------------------------------------
+
+/** @import { SuggestedEdit } from "@eslint/core"; */
+
+//------------------------------------------------------------------------------
+// Helpers
+//------------------------------------------------------------------------------
+
+const parser = new regexpp.RegExpParser();
+
+/**
+ * Creates fixer suggestions for the regex, if statically determinable.
+ * @param {number} groupStart Starting index of the regex group.
+ * @param {string} pattern The regular expression pattern to be checked.
+ * @param {string} rawText Source text of the regexNode.
+ * @param {ASTNode} regexNode AST node which contains the regular expression.
+ * @returns {Array<SuggestedEdit>} Fixer suggestions for the regex, if statically determinable.
+ */
+function suggestIfPossible(groupStart, pattern, rawText, regexNode) {
+	switch (regexNode.type) {
+		case "Literal":
+			if (typeof regexNode.value === "string" && rawText.includes("\\")) {
+				return null;
+			}
+			break;
+		case "TemplateLiteral":
+			if (
+				regexNode.expressions.length ||
+				rawText.slice(1, -1) !== pattern
+			) {
+				return null;
+			}
+			break;
+		default:
+			return null;
+	}
+
+	const start = regexNode.range[0] + groupStart + 2;
+
+	return [
+		{
+			fix(fixer) {
+				const existingTemps = pattern.match(/temp\d+/gu) || [];
+				const highestTempCount = existingTemps.reduce(
+					(previous, next) =>
+						Math.max(previous, Number(next.slice("temp".length))),
+					0,
+				);
+
+				return fixer.insertTextBeforeRange(
+					[start, start],
+					`?<temp${highestTempCount + 1}>`,
+				);
+			},
+			messageId: "addGroupName",
+		},
+		{
+			fix(fixer) {
+				return fixer.insertTextBeforeRange([start, start], "?:");
+			},
+			messageId: "addNonCapture",
+		},
+	];
+}
+
+//------------------------------------------------------------------------------
+// Rule Definition
+//------------------------------------------------------------------------------
+
+/** @type {import('../types').Rule.RuleModule} */
+module.exports = {
+	meta: {
+		type: "suggestion",
+
+		docs: {
+			description:
+				"Enforce using named capture group in regular expression",
+			recommended: false,
+			url: "https://eslint.org/docs/latest/rules/prefer-named-capture-group",
+		},
+
+		hasSuggestions: true,
+
+		schema: [],
+
+		messages: {
+			addGroupName: "Add name to capture group.",
+			addNonCapture: "Convert group to non-capturing.",
+			required:
+				"Capture group '{{group}}' should be converted to a named or non-capturing group.",
+		},
+	},
+
+	create(context) {
+		const sourceCode = context.sourceCode;
+
+		/**
+		 * Function to check regular expression.
+		 * @param {string} pattern The regular expression pattern to be checked.
+		 * @param {ASTNode} node AST node which contains the regular expression or a call/new expression.
+		 * @param {ASTNode} regexNode AST node which contains the regular expression.
+		 * @param {string|null} flags The regular expression flags to be checked.
+		 * @returns {void}
+		 */
+		function checkRegex(pattern, node, regexNode, flags) {
+			let ast;
+
+			try {
+				ast = parser.parsePattern(pattern, 0, pattern.length, {
+					unicode: Boolean(flags && flags.includes("u")),
+					unicodeSets: Boolean(flags && flags.includes("v")),
+				});
+			} catch {
+				// ignore regex syntax errors
+				return;
+			}
+
+			regexpp.visitRegExpAST(ast, {
+				onCapturingGroupEnter(group) {
+					if (!group.name) {
+						const rawText = sourceCode.getText(regexNode);
+						const suggest = suggestIfPossible(
+							group.start,
+							pattern,
+							rawText,
+							regexNode,
+						);
+
+						context.report({
+							node,
+							messageId: "required",
+							data: {
+								group: group.raw,
+							},
+							suggest,
+						});
+					}
+				},
+			});
+		}
+
+		return {
+			Literal(node) {
+				if (node.regex) {
+					checkRegex(
+						node.regex.pattern,
+						node,
+						node,
+						node.regex.flags,
+					);
+				}
+			},
+			Program(node) {
+				const scope = sourceCode.getScope(node);
+				const tracker = new ReferenceTracker(scope);
+				const traceMap = {
+					RegExp: {
+						[CALL]: true,
+						[CONSTRUCT]: true,
+					},
+				};
+
+				for (const { node: refNode } of tracker.iterateGlobalReferences(
+					traceMap,
+				)) {
+					const regex = getStringIfConstant(refNode.arguments[0]);
+					const flags = getStringIfConstant(refNode.arguments[1]);
+
+					if (regex) {
+						checkRegex(regex, refNode, refNode.arguments[0], flags);
+					}
+				}
+			},
+		};
+	},
+};