feat: Phase 1 — extract the client (web SPA + desktop) to dtoro/oikos-web

Problem: the hexagonal refactor churns the backend tree for nine more
phases; the UI delivery stack (web/ SPA, cmd/desktop Wails wrapper,
compose/web image) must move to its own repo first so doc/layout
rewrites land once on a backend-only tree.

Change:
- New repo git.hubris.network/dtoro/oikos-web (v0.33.0): web/, desktop/
  (updateURL repointed to oikos-web releases), compose/, own CI (web +
  desktop jobs), own deploy script (CI-green gate, TOCTOU guard,
  version-tagged images, prune-to-3), own webhook receiver on :9798 +
  launchd unit, own compose project publishing the same 8091:80.
- Cutover executed on mac-mini in order: oikos stack's web service
  stopped+removed, oikos-web project brought up on 8091; outer Caddy
  untouched (targets the published port) — serving + Authentik flow +
  /wails 404 quirk verified post-cutover.
- Stripped from oikos: web/, cmd/desktop/, compose/web/, desktop CI
  workflow, ci.yml web job, Makefile ui/desktop/desktop-package/install
  targets, the compose web service, oikos-web from deploy.sh's fallback
  prune list; wails + go-keyring dropped from go.mod, vendor synced.
- README / CONTRIBUTING / AGENTS.md / .agents dev+operations docs now
  point at the new repo; mbse + mascot design docs carry a path note.

Risk: production SPA serving depends on the new pipeline now; rollback
is versioned-image re-up of the old web service from a pre-split
checkout (port 8091). Desktop builds installed before the split still
check dtoro/oikos releases — one manual reinstall, noted in the
oikos-web release notes.

Verification: go vet, make test (race), make generate-check, golangci
(no new findings; baseline down 400→365); post-cutover curls —
localhost:8091 200, /wails/runtime.js 404, outer Caddy 302 Authentik.

web/node_modules/eslint-scope/lib/pattern-visitor.js

@@ -0,0 +1,154 @@
+/*
+  Copyright (C) 2015 Yusuke Suzuki <utatane.tea@gmail.com>
+
+  Redistribution and use in source and binary forms, with or without
+  modification, are permitted provided that the following conditions are met:
+
+    * Redistributions of source code must retain the above copyright
+      notice, this list of conditions and the following disclaimer.
+    * Redistributions in binary form must reproduce the above copyright
+      notice, this list of conditions and the following disclaimer in the
+      documentation and/or other materials provided with the distribution.
+
+  THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS"
+  AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+  IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+  ARE DISCLAIMED. IN NO EVENT SHALL <COPYRIGHT HOLDER> BE LIABLE FOR ANY
+  DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+  (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+  LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
+  ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+  (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
+  THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+*/
+
+import estraverse from "estraverse";
+import esrecurse from "esrecurse";
+
+const { Syntax } = estraverse;
+
+/**
+ * Get last array element
+ * @param {Array} xs array
+ * @returns {any} Last elment
+ */
+function getLast(xs) {
+    return xs.at(-1) || null;
+}
+
+/**
+ * Visitor for destructuring patterns.
+ */
+class PatternVisitor extends esrecurse.Visitor {
+    static isPattern(node) {
+        const nodeType = node.type;
+
+        return (
+            nodeType === Syntax.Identifier ||
+            nodeType === Syntax.ObjectPattern ||
+            nodeType === Syntax.ArrayPattern ||
+            nodeType === Syntax.SpreadElement ||
+            nodeType === Syntax.RestElement ||
+            nodeType === Syntax.AssignmentPattern
+        );
+    }
+
+    constructor(options, rootPattern, callback) {
+        super(null, options);
+        this.rootPattern = rootPattern;
+        this.callback = callback;
+        this.assignments = [];
+        this.rightHandNodes = [];
+        this.restElements = [];
+    }
+
+    Identifier(pattern) {
+        const lastRestElement = getLast(this.restElements);
+
+        this.callback(pattern, {
+            topLevel: pattern === this.rootPattern,
+            rest: lastRestElement !== null && lastRestElement !== void 0 && lastRestElement.argument === pattern,
+            assignments: this.assignments
+        });
+    }
+
+    Property(property) {
+
+        // Computed property's key is a right hand node.
+        if (property.computed) {
+            this.rightHandNodes.push(property.key);
+        }
+
+        // If it's shorthand, its key is same as its value.
+        // If it's shorthand and has its default value, its key is same as its value.left (the value is AssignmentPattern).
+        // If it's not shorthand, the name of new variable is its value's.
+        this.visit(property.value);
+    }
+
+    ArrayPattern(pattern) {
+        for (let i = 0, iz = pattern.elements.length; i < iz; ++i) {
+            const element = pattern.elements[i];
+
+            this.visit(element);
+        }
+    }
+
+    AssignmentPattern(pattern) {
+        this.assignments.push(pattern);
+        this.visit(pattern.left);
+        this.rightHandNodes.push(pattern.right);
+        this.assignments.pop();
+    }
+
+    RestElement(pattern) {
+        this.restElements.push(pattern);
+        this.visit(pattern.argument);
+        this.restElements.pop();
+    }
+
+    MemberExpression(node) {
+
+        // Computed property's key is a right hand node.
+        if (node.computed) {
+            this.rightHandNodes.push(node.property);
+        }
+
+        // the object is only read, write to its property.
+        this.rightHandNodes.push(node.object);
+    }
+
+    //
+    // ForInStatement.left and AssignmentExpression.left are LeftHandSideExpression.
+    // By spec, LeftHandSideExpression is Pattern or MemberExpression.
+    //   (see also: https://github.com/estree/estree/pull/20#issuecomment-74584758)
+    // But espree 2.0 parses to ArrayExpression, ObjectExpression, etc...
+    //
+
+    SpreadElement(node) {
+        this.visit(node.argument);
+    }
+
+    ArrayExpression(node) {
+        node.elements.forEach(this.visit, this);
+    }
+
+    AssignmentExpression(node) {
+        this.assignments.push(node);
+        this.visit(node.left);
+        this.rightHandNodes.push(node.right);
+        this.assignments.pop();
+    }
+
+    CallExpression(node) {
+
+        // arguments are right hand nodes.
+        node.arguments.forEach(a => {
+            this.rightHandNodes.push(a);
+        });
+        this.visit(node.callee);
+    }
+}
+
+export default PatternVisitor;
+
+/* vim: set sw=4 ts=4 et tw=80 : */