feat: Phase 1 — extract the client (web SPA + desktop) to dtoro/oikos-web

Problem: the hexagonal refactor churns the backend tree for nine more
phases; the UI delivery stack (web/ SPA, cmd/desktop Wails wrapper,
compose/web image) must move to its own repo first so doc/layout
rewrites land once on a backend-only tree.

Change:
- New repo git.hubris.network/dtoro/oikos-web (v0.33.0): web/, desktop/
  (updateURL repointed to oikos-web releases), compose/, own CI (web +
  desktop jobs), own deploy script (CI-green gate, TOCTOU guard,
  version-tagged images, prune-to-3), own webhook receiver on :9798 +
  launchd unit, own compose project publishing the same 8091:80.
- Cutover executed on mac-mini in order: oikos stack's web service
  stopped+removed, oikos-web project brought up on 8091; outer Caddy
  untouched (targets the published port) — serving + Authentik flow +
  /wails 404 quirk verified post-cutover.
- Stripped from oikos: web/, cmd/desktop/, compose/web/, desktop CI
  workflow, ci.yml web job, Makefile ui/desktop/desktop-package/install
  targets, the compose web service, oikos-web from deploy.sh's fallback
  prune list; wails + go-keyring dropped from go.mod, vendor synced.
- README / CONTRIBUTING / AGENTS.md / .agents dev+operations docs now
  point at the new repo; mbse + mascot design docs carry a path note.

Risk: production SPA serving depends on the new pipeline now; rollback
is versioned-image re-up of the old web service from a pre-split
checkout (port 8091). Desktop builds installed before the split still
check dtoro/oikos releases — one manual reinstall, noted in the
oikos-web release notes.

Verification: go vet, make test (race), make generate-check, golangci
(no new findings; baseline down 400→365); post-cutover curls —
localhost:8091 200, /wails/runtime.js 404, outer Caddy 302 Authentik.

web/node_modules/eslint-plugin-svelte/lib/rules/no-reactive-reassign.js

@@ -0,0 +1,215 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+const utils_1 = require("../utils");
+const eslint_utils_1 = require("@eslint-community/eslint-utils");
+const compat_1 = require("../utils/compat");
+exports.default = (0, utils_1.createRule)('no-reactive-reassign', {
+    meta: {
+        docs: {
+            description: 'disallow reassigning reactive values',
+            category: 'Possible Errors',
+            // TODO Switch to recommended in the major version.
+            recommended: false
+        },
+        schema: [
+            {
+                type: 'object',
+                properties: {
+                    props: {
+                        type: 'boolean'
+                    }
+                },
+                additionalProperties: false
+            }
+        ],
+        messages: {
+            assignmentToReactiveValue: "Assignment to reactive value '{{name}}'.",
+            assignmentToReactiveValueProp: "Assignment to property of reactive value '{{name}}'."
+        },
+        type: 'problem'
+    },
+    create(context) {
+        const props = context.options[0]?.props !== false; // default true
+        const sourceCode = (0, compat_1.getSourceCode)(context);
+        const scopeManager = sourceCode.scopeManager;
+        const globalScope = scopeManager.globalScope;
+        const toplevelScope = globalScope?.childScopes.find((scope) => scope.type === 'module') || globalScope;
+        if (!globalScope || !toplevelScope) {
+            return {};
+        }
+        const CHECK_REASSIGN = {
+            UpdateExpression: 
+            // e.g. foo ++, foo --
+            ({ parent }) => ({ type: 'reassign', node: parent }),
+            UnaryExpression: ({ parent }) => {
+                if (parent.operator === 'delete') {
+                    // e.g. delete foo.prop
+                    return { type: 'reassign', node: parent };
+                }
+                return null;
+            },
+            AssignmentExpression: ({ node, parent }) => {
+                if (parent.left === node) {
+                    // e.g. foo = 42, foo += 42, foo -= 42
+                    return { type: 'reassign', node: parent };
+                }
+                return null;
+            },
+            ForInStatement: ({ node, parent }) => {
+                if (parent.left === node) {
+                    // e.g. for (foo in itr)
+                    return { type: 'reassign', node: parent };
+                }
+                return null;
+            },
+            ForOfStatement: ({ node, parent }) => {
+                if (parent.left === node) {
+                    // e.g. for (foo of itr)
+                    return { type: 'reassign', node: parent };
+                }
+                return null;
+            },
+            CallExpression: ({ node, parent, pathNodes }) => {
+                if (pathNodes.length > 0 && parent.callee === node) {
+                    const mem = pathNodes[pathNodes.length - 1];
+                    const callName = (0, eslint_utils_1.getPropertyName)(mem);
+                    if (callName &&
+                        /^(?:push|pop|shift|unshift|reverse|splice|sort|copyWithin|fill)$/u.test(callName)) {
+                        // e.g. foo.push()
+                        return {
+                            type: 'reassign',
+                            node: parent,
+                            pathNodes: pathNodes.slice(0, -1)
+                        };
+                    }
+                }
+                return null;
+            },
+            MemberExpression: ({ node, parent, pathNodes }) => {
+                if (parent.object === node) {
+                    // The context to check next.
+                    return {
+                        type: 'check',
+                        node: parent,
+                        pathNodes: [...pathNodes, parent]
+                    };
+                }
+                return null;
+            },
+            ChainExpression: ({ parent }) => {
+                // e.g. `foo?.prop`
+                // The context to check next.
+                return { type: 'check', node: parent };
+            },
+            ConditionalExpression: ({ node, parent }) => {
+                if (parent.test === node) {
+                    return null;
+                }
+                // The context to check next for `(test ? foo : bar).prop`.
+                return { type: 'check', node: parent };
+            },
+            Property: ({ node, parent }) => {
+                if (parent.value === node && parent.parent && parent.parent.type === 'ObjectPattern') {
+                    // The context to check next for `({a: foo} = obj)`.
+                    return { type: 'check', node: parent.parent };
+                }
+                return null;
+            },
+            ArrayPattern: ({ node, parent }) => {
+                if (parent.elements.includes(node)) {
+                    // The context to check next for `([foo] = obj)`.
+                    return { type: 'check', node: parent };
+                }
+                return null;
+            },
+            RestElement: ({ node, parent }) => {
+                if (parent.argument === node && parent.parent) {
+                    // The context to check next for `({...foo} = obj)`.
+                    return {
+                        type: 'check',
+                        node: parent.parent
+                    };
+                }
+                return null;
+            },
+            SvelteDirective: ({ node, parent }) => {
+                if (parent.kind !== 'Binding') {
+                    return null;
+                }
+                if (parent.shorthand || parent.expression === node) {
+                    return {
+                        type: 'reassign',
+                        node: parent
+                    };
+                }
+                return null;
+            }
+        };
+        /**
+         * Returns the reassign information for the given expression node if it has a reassign.
+         */
+        function getReassignData(expr) {
+            let pathNodes = [];
+            let node = expr;
+            let parent;
+            while ((parent = node.parent)) {
+                const check = CHECK_REASSIGN[parent.type];
+                if (!check) {
+                    return null;
+                }
+                const result = check({ node, parent, pathNodes });
+                if (!result) {
+                    return null;
+                }
+                pathNodes = result.pathNodes || pathNodes;
+                if (result.type === 'reassign') {
+                    return {
+                        node: result.node,
+                        pathNodes
+                    };
+                }
+                node = result.node;
+            }
+            return null;
+        }
+        return {
+            SvelteReactiveStatement(node) {
+                if (node.body.type !== 'ExpressionStatement' ||
+                    node.body.expression.type !== 'AssignmentExpression' ||
+                    node.body.expression.operator !== '=') {
+                    return;
+                }
+                const assignment = node.body.expression;
+                for (const variable of toplevelScope.variables) {
+                    if (!variable.defs.some((def) => def.node === assignment)) {
+                        continue;
+                    }
+                    for (const reference of variable.references) {
+                        const id = reference.identifier;
+                        if ((assignment.left.range[0] <= id.range[0] &&
+                            id.range[1] <= assignment.left.range[1]) ||
+                            id.type === 'JSXIdentifier') {
+                            continue;
+                        }
+                        const reassign = getReassignData(id);
+                        if (!reassign) {
+                            continue;
+                        }
+                        // Suppresses reporting if the props option is set to `false` and reassigned to properties.
+                        if (!props && reassign.pathNodes.length > 0)
+                            continue;
+                        context.report({
+                            node: reassign.node,
+                            messageId: reassign.pathNodes.length === 0
+                                ? 'assignmentToReactiveValue'
+                                : 'assignmentToReactiveValueProp',
+                            data: {
+                                name: id.name
+                            }
+                        });
+                    }
+                }
+            }
+        };
+    }
+});