feat: Phase 1 — extract the client (web SPA + desktop) to dtoro/oikos-web

Problem: the hexagonal refactor churns the backend tree for nine more
phases; the UI delivery stack (web/ SPA, cmd/desktop Wails wrapper,
compose/web image) must move to its own repo first so doc/layout
rewrites land once on a backend-only tree.

Change:
- New repo git.hubris.network/dtoro/oikos-web (v0.33.0): web/, desktop/
  (updateURL repointed to oikos-web releases), compose/, own CI (web +
  desktop jobs), own deploy script (CI-green gate, TOCTOU guard,
  version-tagged images, prune-to-3), own webhook receiver on :9798 +
  launchd unit, own compose project publishing the same 8091:80.
- Cutover executed on mac-mini in order: oikos stack's web service
  stopped+removed, oikos-web project brought up on 8091; outer Caddy
  untouched (targets the published port) — serving + Authentik flow +
  /wails 404 quirk verified post-cutover.
- Stripped from oikos: web/, cmd/desktop/, compose/web/, desktop CI
  workflow, ci.yml web job, Makefile ui/desktop/desktop-package/install
  targets, the compose web service, oikos-web from deploy.sh's fallback
  prune list; wails + go-keyring dropped from go.mod, vendor synced.
- README / CONTRIBUTING / AGENTS.md / .agents dev+operations docs now
  point at the new repo; mbse + mascot design docs carry a path note.

Risk: production SPA serving depends on the new pipeline now; rollback
is versioned-image re-up of the old web service from a pre-split
checkout (port 8091). Desktop builds installed before the split still
check dtoro/oikos releases — one manual reinstall, noted in the
oikos-web release notes.

Verification: go vet, make test (race), make generate-check, golangci
(no new findings; baseline down 400→365); post-cutover curls —
localhost:8091 200, /wails/runtime.js 404, outer Caddy 302 Authentik.

web/node_modules/eslint-plugin-svelte/lib/shared/comment-directives.js

@@ -0,0 +1,162 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.CommentDirectives = void 0;
+const COMPUTED = Symbol();
+const ALL = Symbol();
+class CommentDirectives {
+    constructor(options) {
+        this.lineDisableDirectives = new Map();
+        this.blockDirectives = new Map();
+        this.ruleId = options.ruleId;
+        this.reportUnusedDisableDirectives = Boolean(options?.reportUnusedDisableDirectives);
+    }
+    filterMessages(messages) {
+        const { lineDisableDirectives, blockDirectives, reportUnusedDisableDirectives } = this;
+        const usedDirectives = new Set();
+        if (reportUnusedDisableDirectives) {
+            const allBlocks = [];
+            for (const bs of blockDirectives.values()) {
+                for (const b of bs) {
+                    allBlocks.push(b);
+                }
+            }
+            const blockEnableDirectives = new Set();
+            for (const block of allBlocks.sort((a, b) => comparePos(b.loc, a.loc))) {
+                if (block.kind === 'enable') {
+                    if (block.targetRule === ALL) {
+                        blockEnableDirectives.clear();
+                    }
+                    blockEnableDirectives.add(block);
+                }
+                else if (block.kind === 'disable') {
+                    if (block.targetRule === ALL) {
+                        for (const b of blockEnableDirectives) {
+                            usedDirectives.add(b);
+                        }
+                        blockEnableDirectives.clear();
+                    }
+                    else {
+                        for (const b of [...blockEnableDirectives]) {
+                            if (block.targetRule === b.targetRule || b.targetRule === ALL) {
+                                usedDirectives.add(b);
+                                blockEnableDirectives.delete(b);
+                            }
+                        }
+                    }
+                }
+            }
+        }
+        let filteredMessages = messages.filter(isEnable);
+        if (reportUnusedDisableDirectives) {
+            const usedDirectiveKeys = new Set([...usedDirectives].map((d) => locToKey(d.define.loc)));
+            filteredMessages = filteredMessages.filter((m) => {
+                if (m.ruleId !== this.ruleId) {
+                    return true;
+                }
+                if (usedDirectiveKeys.has(messageToKey(m))) {
+                    return false;
+                }
+                return true;
+            });
+        }
+        return filteredMessages;
+        /** Checks wether given rule is enable */
+        function isEnable(message) {
+            if (!message.ruleId) {
+                // Maybe fatal error
+                return true;
+            }
+            for (const disableLines of getFromRule(lineDisableDirectives, message.ruleId)) {
+                for (const disableLine of disableLines.get(message.line) ?? []) {
+                    if (!disableLine.rule(message.ruleId)) {
+                        continue;
+                    }
+                    usedDirectives.add(disableLine);
+                    return false;
+                }
+            }
+            const blocks = getFromRule(blockDirectives, message.ruleId)
+                .reduce((p, c) => p.concat(c), [])
+                .sort((a, b) => comparePos(b.loc, a.loc));
+            for (const block of blocks) {
+                if (comparePos(message, block.loc) < 0) {
+                    continue;
+                }
+                if (!block.rule(message.ruleId)) {
+                    continue;
+                }
+                if (block.kind === 'enable') {
+                    return true;
+                }
+                // block.kind === "disable"
+                usedDirectives.add(block);
+                return false;
+            }
+            return true;
+        }
+        /** Compare locations */
+        function comparePos(a, b) {
+            return a.line - b.line || a.column - b.column;
+        }
+    }
+    disableLine(line, rule, define) {
+        const key = typeof rule === 'string' ? rule : COMPUTED;
+        let disableLines = this.lineDisableDirectives.get(key);
+        if (!disableLines) {
+            disableLines = new Map();
+            this.lineDisableDirectives.set(key, disableLines);
+        }
+        let disableLine = disableLines.get(line);
+        if (!disableLine) {
+            disableLine = [];
+            disableLines.set(line, disableLine);
+        }
+        const disable = {
+            line,
+            rule: typeof rule === 'string' ? (id) => id === rule : rule,
+            define
+        };
+        disableLine.push(disable);
+    }
+    disableBlock(pos, rule, define) {
+        this.block(pos, rule, define, 'disable');
+    }
+    enableBlock(pos, rule, define) {
+        this.block(pos, rule, define, 'enable');
+    }
+    block(pos, rule, define, kind) {
+        const key = typeof rule === 'string' ? rule : COMPUTED;
+        let blocks = this.blockDirectives.get(key);
+        if (!blocks) {
+            blocks = [];
+            this.blockDirectives.set(key, blocks);
+        }
+        const disable = {
+            loc: pos,
+            rule: typeof rule === 'string' ? (id) => id === rule : rule,
+            kind,
+            targetRule: typeof rule === 'string' ? rule : ALL,
+            define
+        };
+        blocks.push(disable);
+    }
+}
+exports.CommentDirectives = CommentDirectives;
+/** Get the list of directives from given rule  */
+function getFromRule(map, ruleId) {
+    return [map.get(ruleId), map.get(COMPUTED)].filter((a) => Boolean(a));
+}
+/**
+ * Gets the key of location
+ */
+function locToKey(location) {
+    return `line:${location.line},column${location.column}`;
+}
+/**
+ * Gets the key of message location
+ */
+function messageToKey(message) {
+    return `line:${message.line},column${
+    // -1 because +1 by ESLint's `report-translator`.
+    message.column - 1}`;
+}