feat: Phase 1 — extract the client (web SPA + desktop) to dtoro/oikos-web

Problem: the hexagonal refactor churns the backend tree for nine more
phases; the UI delivery stack (web/ SPA, cmd/desktop Wails wrapper,
compose/web image) must move to its own repo first so doc/layout
rewrites land once on a backend-only tree.

Change:
- New repo git.hubris.network/dtoro/oikos-web (v0.33.0): web/, desktop/
  (updateURL repointed to oikos-web releases), compose/, own CI (web +
  desktop jobs), own deploy script (CI-green gate, TOCTOU guard,
  version-tagged images, prune-to-3), own webhook receiver on :9798 +
  launchd unit, own compose project publishing the same 8091:80.
- Cutover executed on mac-mini in order: oikos stack's web service
  stopped+removed, oikos-web project brought up on 8091; outer Caddy
  untouched (targets the published port) — serving + Authentik flow +
  /wails 404 quirk verified post-cutover.
- Stripped from oikos: web/, cmd/desktop/, compose/web/, desktop CI
  workflow, ci.yml web job, Makefile ui/desktop/desktop-package/install
  targets, the compose web service, oikos-web from deploy.sh's fallback
  prune list; wails + go-keyring dropped from go.mod, vendor synced.
- README / CONTRIBUTING / AGENTS.md / .agents dev+operations docs now
  point at the new repo; mbse + mascot design docs carry a path note.

Risk: production SPA serving depends on the new pipeline now; rollback
is versioned-image re-up of the old web service from a pre-split
checkout (port 8091). Desktop builds installed before the split still
check dtoro/oikos releases — one manual reinstall, noted in the
oikos-web release notes.

Verification: go vet, make test (race), make generate-check, golangci
(no new findings; baseline down 400→365); post-cutover curls —
localhost:8091 200, /wails/runtime.js 404, outer Caddy 302 Authentik.

web/node_modules/fsevents/fsevents.js

@@ -0,0 +1,83 @@
+/*
+ ** © 2020 by Philipp Dunkel, Ben Noordhuis, Elan Shankar, Paul Miller
+ ** Licensed under MIT License.
+ */
+
+/* jshint node:true */
+"use strict";
+
+if (process.platform !== "darwin") {
+  throw new Error(`Module 'fsevents' is not compatible with platform '${process.platform}'`);
+}
+
+const Native = require("./fsevents.node");
+const events = Native.constants;
+
+function watch(path, since, handler) {
+  if (typeof path !== "string") {
+    throw new TypeError(`fsevents argument 1 must be a string and not a ${typeof path}`);
+  }
+  if ("function" === typeof since && "undefined" === typeof handler) {
+    handler = since;
+    since = Native.flags.SinceNow;
+  }
+  if (typeof since !== "number") {
+    throw new TypeError(`fsevents argument 2 must be a number and not a ${typeof since}`);
+  }
+  if (typeof handler !== "function") {
+    throw new TypeError(`fsevents argument 3 must be a function and not a ${typeof handler}`);
+  }
+
+  let instance = Native.start(Native.global, path, since, handler);
+  if (!instance) throw new Error(`could not watch: ${path}`);
+  return () => {
+    const result = instance ? Promise.resolve(instance).then(Native.stop) : Promise.resolve(undefined);
+    instance = undefined;
+    return result;
+  };
+}
+
+function getInfo(path, flags) {
+  return {
+    path,
+    flags,
+    event: getEventType(flags),
+    type: getFileType(flags),
+    changes: getFileChanges(flags),
+  };
+}
+
+function getFileType(flags) {
+  if (events.ItemIsFile & flags) return "file";
+  if (events.ItemIsDir & flags) return "directory";
+  if (events.MustScanSubDirs & flags) return "directory"; 
+  if (events.ItemIsSymlink & flags) return "symlink";
+}
+function anyIsTrue(obj) {
+  for (let key in obj) {
+    if (obj[key]) return true;
+  }
+  return false;
+}
+function getEventType(flags) {
+  if (events.ItemRemoved & flags) return "deleted";
+  if (events.ItemRenamed & flags) return "moved";
+  if (events.ItemCreated & flags) return "created";
+  if (events.ItemModified & flags) return "modified";
+  if (events.RootChanged & flags) return "root-changed";
+  if (events.ItemCloned & flags) return "cloned";
+  if (anyIsTrue(flags)) return "modified";
+  return "unknown";
+}
+function getFileChanges(flags) {
+  return {
+    inode: !!(events.ItemInodeMetaMod & flags),
+    finder: !!(events.ItemFinderInfoMod & flags),
+    access: !!(events.ItemChangeOwner & flags),
+    xattrs: !!(events.ItemXattrMod & flags),
+  };
+}
+
+exports.watch = watch;
+exports.getInfo = getInfo;
+exports.constants = events;