feat: Phase 1 — extract the client (web SPA + desktop) to dtoro/oikos-web

Problem: the hexagonal refactor churns the backend tree for nine more
phases; the UI delivery stack (web/ SPA, cmd/desktop Wails wrapper,
compose/web image) must move to its own repo first so doc/layout
rewrites land once on a backend-only tree.

Change:
- New repo git.hubris.network/dtoro/oikos-web (v0.33.0): web/, desktop/
  (updateURL repointed to oikos-web releases), compose/, own CI (web +
  desktop jobs), own deploy script (CI-green gate, TOCTOU guard,
  version-tagged images, prune-to-3), own webhook receiver on :9798 +
  launchd unit, own compose project publishing the same 8091:80.
- Cutover executed on mac-mini in order: oikos stack's web service
  stopped+removed, oikos-web project brought up on 8091; outer Caddy
  untouched (targets the published port) — serving + Authentik flow +
  /wails 404 quirk verified post-cutover.
- Stripped from oikos: web/, cmd/desktop/, compose/web/, desktop CI
  workflow, ci.yml web job, Makefile ui/desktop/desktop-package/install
  targets, the compose web service, oikos-web from deploy.sh's fallback
  prune list; wails + go-keyring dropped from go.mod, vendor synced.
- README / CONTRIBUTING / AGENTS.md / .agents dev+operations docs now
  point at the new repo; mbse + mascot design docs carry a path note.

Risk: production SPA serving depends on the new pipeline now; rollback
is versioned-image re-up of the old web service from a pre-split
checkout (port 8091). Desktop builds installed before the split still
check dtoro/oikos releases — one manual reinstall, noted in the
oikos-web release notes.

Verification: go vet, make test (race), make generate-check, golangci
(no new findings; baseline down 400→365); post-cutover curls —
localhost:8091 200, /wails/runtime.js 404, outer Caddy 302 Authentik.

web/node_modules/eslint-compat-utils/dist/eslint.mjs

@@ -0,0 +1,160 @@
+import * as eslint from 'eslint';
+import * as semver from 'semver';
+import { c as convertConfigToRc } from './shared/eslint-compat-utils.1a5060cf.mjs';
+import { g as getUnsupported } from './shared/eslint-compat-utils.3ecba7ac.mjs';
+import 'module';
+
+var __defProp = Object.defineProperty;
+var __defNormalProp = (obj, key, value) => key in obj ? __defProp(obj, key, { enumerable: true, configurable: true, writable: true, value }) : obj[key] = value;
+var __publicField = (obj, key, value) => {
+  __defNormalProp(obj, typeof key !== "symbol" ? key + "" : key, value);
+  return value;
+};
+let cacheESLint, cacheLegacyESLint;
+function getESLint() {
+  return cacheESLint != null ? cacheESLint : cacheESLint = getESLintInternal();
+  function getESLintInternal() {
+    if (semver.gte(eslint.Linter.version, "9.0.0-0")) {
+      return eslint.ESLint;
+    }
+    return getUnsupported().FlatESLint || (eslint.ESLint ? getESLintClassFromLegacyESLint(eslint.ESLint) : getESLintClassFromLegacyESLint(getLegacyESLintClassFromCLIEngine()));
+  }
+}
+function getLegacyESLint() {
+  return cacheLegacyESLint != null ? cacheLegacyESLint : cacheLegacyESLint = getLegacyESLintInternal();
+  function getLegacyESLintInternal() {
+    return getUnsupported().LegacyESLint || eslint.ESLint || getLegacyESLintClassFromCLIEngine();
+  }
+}
+function getESLintClassFromLegacyESLint(legacyESLintClass) {
+  return class ESLintFromLegacyESLint extends legacyESLintClass {
+    static get version() {
+      return legacyESLintClass.version;
+    }
+    constructor(options) {
+      super(adjustOptions(options));
+    }
+  };
+  function adjustOptions(options) {
+    const {
+      baseConfig: originalBaseConfig,
+      overrideConfig: originalOverrideConfig,
+      overrideConfigFile,
+      ...newOptions
+    } = options || {};
+    if (originalBaseConfig) {
+      const [baseConfig, plugins] = convertConfig(originalBaseConfig);
+      newOptions.baseConfig = baseConfig;
+      if (plugins) {
+        newOptions.plugins = plugins;
+      }
+    }
+    if (originalOverrideConfig) {
+      const [overrideConfig, plugins] = convertConfig(originalOverrideConfig);
+      newOptions.overrideConfig = overrideConfig;
+      if (plugins) {
+        newOptions.plugins = plugins;
+      }
+    }
+    if (overrideConfigFile) {
+      if (overrideConfigFile === true) {
+        newOptions.useEslintrc = false;
+      } else {
+        newOptions.overrideConfigFile = overrideConfigFile;
+      }
+    }
+    return newOptions;
+  }
+  function convertConfig(config) {
+    const pluginDefs = {};
+    const newConfigs = [];
+    for (const configItem of Array.isArray(config) ? config : [config]) {
+      const { plugins, ...otherConfig } = configItem;
+      if (typeof otherConfig.processor !== "string")
+        delete otherConfig.processor;
+      const newConfig = {
+        files: ["**/*.*", "*.*", "**/*", "*"],
+        ...convertConfigToRc(otherConfig)
+      };
+      if (plugins) {
+        newConfig.plugins = Object.keys(plugins);
+      }
+      Object.assign(pluginDefs, plugins);
+      newConfigs.push(newConfig);
+    }
+    return [{ overrides: newConfigs }, pluginDefs];
+  }
+}
+function getLegacyESLintClassFromCLIEngine() {
+  const CLIEngine = eslint.CLIEngine;
+  class LegacyESLintFromCLIEngine {
+    constructor(options) {
+      __publicField(this, "engine");
+      const {
+        overrideConfig: {
+          plugins,
+          globals,
+          rules,
+          overrides,
+          ...overrideConfig
+        } = {
+          plugins: [],
+          globals: {},
+          rules: {},
+          overrides: []
+        },
+        fix,
+        reportUnusedDisableDirectives,
+        plugins: pluginsMap,
+        ...otherOptions
+      } = options || {};
+      const cliEngineOptions = {
+        baseConfig: {
+          ...overrides ? {
+            overrides
+          } : {}
+        },
+        fix: Boolean(fix),
+        reportUnusedDisableDirectives: reportUnusedDisableDirectives ? reportUnusedDisableDirectives !== "off" : void 0,
+        ...otherOptions,
+        globals: globals ? Object.keys(globals).filter((n) => globals[n]) : void 0,
+        plugins: plugins || [],
+        rules: rules ? Object.fromEntries(
+          Object.entries(rules).flatMap(
+            ([ruleId, opt]) => opt ? [[ruleId, opt]] : []
+          )
+        ) : void 0,
+        ...overrideConfig
+      };
+      this.engine = new CLIEngine(cliEngineOptions);
+      for (const [name, plugin] of Object.entries(pluginsMap || {})) {
+        this.engine.addPlugin(name, plugin);
+      }
+    }
+    static get version() {
+      return CLIEngine.version;
+    }
+    // eslint-disable-next-line @typescript-eslint/require-await -- ignore
+    async lintText(...params) {
+      var _a;
+      const result = this.engine.executeOnText(params[0], (_a = params[1]) == null ? void 0 : _a.filePath);
+      return result.results;
+    }
+    // eslint-disable-next-line @typescript-eslint/require-await -- ignore
+    async lintFiles(...params) {
+      const result = this.engine.executeOnFiles(
+        Array.isArray(params[0]) ? params[0] : [params[0]]
+      );
+      return result.results;
+    }
+    // eslint-disable-next-line @typescript-eslint/require-await -- ignore
+    static async outputFixes(...params) {
+      return CLIEngine.outputFixes({
+        results: params[0]
+      });
+    }
+  }
+  return LegacyESLintFromCLIEngine;
+}
+
+export { getESLint, getLegacyESLint };