feat: Phase 1 — extract the client (web SPA + desktop) to dtoro/oikos-web

Problem: the hexagonal refactor churns the backend tree for nine more
phases; the UI delivery stack (web/ SPA, cmd/desktop Wails wrapper,
compose/web image) must move to its own repo first so doc/layout
rewrites land once on a backend-only tree.

Change:
- New repo git.hubris.network/dtoro/oikos-web (v0.33.0): web/, desktop/
  (updateURL repointed to oikos-web releases), compose/, own CI (web +
  desktop jobs), own deploy script (CI-green gate, TOCTOU guard,
  version-tagged images, prune-to-3), own webhook receiver on :9798 +
  launchd unit, own compose project publishing the same 8091:80.
- Cutover executed on mac-mini in order: oikos stack's web service
  stopped+removed, oikos-web project brought up on 8091; outer Caddy
  untouched (targets the published port) — serving + Authentik flow +
  /wails 404 quirk verified post-cutover.
- Stripped from oikos: web/, cmd/desktop/, compose/web/, desktop CI
  workflow, ci.yml web job, Makefile ui/desktop/desktop-package/install
  targets, the compose web service, oikos-web from deploy.sh's fallback
  prune list; wails + go-keyring dropped from go.mod, vendor synced.
- README / CONTRIBUTING / AGENTS.md / .agents dev+operations docs now
  point at the new repo; mbse + mascot design docs carry a path note.

Risk: production SPA serving depends on the new pipeline now; rollback
is versioned-image re-up of the old web service from a pre-split
checkout (port 8091). Desktop builds installed before the split still
check dtoro/oikos releases — one manual reinstall, noted in the
oikos-web release notes.

Verification: go vet, make test (race), make generate-check, golangci
(no new findings; baseline down 400→365); post-cutover curls —
localhost:8091 200, /wails/runtime.js 404, outer Caddy 302 Authentik.

web/node_modules/eslint-plugin-svelte/lib/rules/html-closing-bracket-new-line.js

@@ -0,0 +1,118 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+const utils_1 = require("../utils");
+const compat_1 = require("../utils/compat");
+function getPhrase(lineBreaks) {
+    switch (lineBreaks) {
+        case 0: {
+            return 'no line breaks';
+        }
+        case 1: {
+            return '1 line break';
+        }
+        default: {
+            return `${lineBreaks} line breaks`;
+        }
+    }
+}
+function getExpectedLineBreaks(node, options, type) {
+    const isSelfClosingTag = node.type === 'SvelteStartTag' && node.selfClosing;
+    if (isSelfClosingTag && options.selfClosingTag && options.selfClosingTag[type]) {
+        return options.selfClosingTag[type] === 'always' ? 1 : 0;
+    }
+    return options[type] === 'always' ? 1 : 0;
+}
+function getSelfClosingData(sourceCode, node, options) {
+    const tokens = sourceCode.getTokens(node);
+    const closingToken = tokens[tokens.length - 2];
+    if (closingToken.value !== '/') {
+        return null;
+    }
+    const prevToken = sourceCode.getTokenBefore(closingToken);
+    const type = node.loc.start.line === prevToken.loc.end.line ? 'singleline' : 'multiline';
+    const expectedLineBreaks = getExpectedLineBreaks(node, options, type);
+    const actualLineBreaks = closingToken.loc.start.line - prevToken.loc.end.line;
+    return { actualLineBreaks, expectedLineBreaks, startToken: prevToken, endToken: closingToken };
+}
+function getNodeData(sourceCode, node, options) {
+    const closingToken = sourceCode.getLastToken(node);
+    if (closingToken.value !== '>') {
+        return null;
+    }
+    const prevToken = sourceCode.getTokenBefore(closingToken);
+    const type = node.loc.start.line === prevToken.loc.end.line ? 'singleline' : 'multiline';
+    const expectedLineBreaks = getExpectedLineBreaks(node, options, type);
+    const actualLineBreaks = closingToken.loc.start.line - prevToken.loc.end.line;
+    return { actualLineBreaks, expectedLineBreaks, startToken: prevToken, endToken: closingToken };
+}
+exports.default = (0, utils_1.createRule)('html-closing-bracket-new-line', {
+    meta: {
+        docs: {
+            description: "Require or disallow a line break before tag's closing brackets",
+            category: 'Stylistic Issues',
+            recommended: false,
+            conflictWithPrettier: true
+        },
+        schema: [
+            {
+                type: 'object',
+                properties: {
+                    singleline: { enum: ['always', 'never'] },
+                    multiline: { enum: ['always', 'never'] },
+                    selfClosingTag: {
+                        type: 'object',
+                        properties: {
+                            singleline: { enum: ['always', 'never'] },
+                            multiline: { enum: ['always', 'never'] }
+                        },
+                        additionalProperties: false,
+                        minProperties: 1
+                    }
+                },
+                additionalProperties: false
+            }
+        ],
+        messages: {
+            expectedBeforeClosingBracket: 'Expected {{expected}} before closing bracket, but {{actual}} found.'
+        },
+        fixable: 'code',
+        type: 'suggestion'
+    },
+    create(context) {
+        const options = context.options[0] ?? {};
+        options.singleline ?? (options.singleline = 'never');
+        options.multiline ?? (options.multiline = 'always');
+        const sourceCode = (0, compat_1.getSourceCode)(context);
+        return {
+            'SvelteStartTag, SvelteEndTag'(node) {
+                const data = node.type === 'SvelteStartTag' && node.selfClosing
+                    ? getSelfClosingData(sourceCode, node, options)
+                    : getNodeData(sourceCode, node, options);
+                if (!data) {
+                    return;
+                }
+                const { actualLineBreaks, expectedLineBreaks, startToken, endToken } = data;
+                if (actualLineBreaks !== expectedLineBreaks) {
+                    // For SvelteEndTag, does not make sense to add a line break, so we only fix if there are extra line breaks
+                    if (node.type === 'SvelteEndTag' && expectedLineBreaks !== 0) {
+                        return;
+                    }
+                    context.report({
+                        node,
+                        loc: { start: startToken.loc.end, end: endToken.loc.start },
+                        messageId: 'expectedBeforeClosingBracket',
+                        data: {
+                            expected: getPhrase(expectedLineBreaks),
+                            actual: getPhrase(actualLineBreaks)
+                        },
+                        fix(fixer) {
+                            const range = [startToken.range[1], endToken.range[0]];
+                            const text = '\n'.repeat(expectedLineBreaks);
+                            return fixer.replaceTextRange(range, text);
+                        }
+                    });
+                }
+            }
+        };
+    }
+});