feat: Phase 1 — extract the client (web SPA + desktop) to dtoro/oikos-web

Problem: the hexagonal refactor churns the backend tree for nine more
phases; the UI delivery stack (web/ SPA, cmd/desktop Wails wrapper,
compose/web image) must move to its own repo first so doc/layout
rewrites land once on a backend-only tree.

Change:
- New repo git.hubris.network/dtoro/oikos-web (v0.33.0): web/, desktop/
  (updateURL repointed to oikos-web releases), compose/, own CI (web +
  desktop jobs), own deploy script (CI-green gate, TOCTOU guard,
  version-tagged images, prune-to-3), own webhook receiver on :9798 +
  launchd unit, own compose project publishing the same 8091:80.
- Cutover executed on mac-mini in order: oikos stack's web service
  stopped+removed, oikos-web project brought up on 8091; outer Caddy
  untouched (targets the published port) — serving + Authentik flow +
  /wails 404 quirk verified post-cutover.
- Stripped from oikos: web/, cmd/desktop/, compose/web/, desktop CI
  workflow, ci.yml web job, Makefile ui/desktop/desktop-package/install
  targets, the compose web service, oikos-web from deploy.sh's fallback
  prune list; wails + go-keyring dropped from go.mod, vendor synced.
- README / CONTRIBUTING / AGENTS.md / .agents dev+operations docs now
  point at the new repo; mbse + mascot design docs carry a path note.

Risk: production SPA serving depends on the new pipeline now; rollback
is versioned-image re-up of the old web service from a pre-split
checkout (port 8091). Desktop builds installed before the split still
check dtoro/oikos releases — one manual reinstall, noted in the
oikos-web release notes.

Verification: go vet, make test (race), make generate-check, golangci
(no new findings; baseline down 400→365); post-cutover curls —
localhost:8091 200, /wails/runtime.js 404, outer Caddy 302 Authentik.

web/node_modules/inline-style-parser/README.md

@@ -0,0 +1,229 @@
+# inline-style-parser
+
+[![NPM](https://nodei.co/npm/inline-style-parser.png)](https://nodei.co/npm/inline-style-parser/)
+
+[![NPM version](https://img.shields.io/npm/v/inline-style-parser)](https://www.npmjs.com/package/inline-style-parser)
+[![NPM bundle size](https://img.shields.io/bundlephobia/minzip/inline-style-parser)](https://bundlephobia.com/package/inline-style-parser)
+[![build](https://github.com/remarkablemark/inline-style-parser/actions/workflows/build.yml/badge.svg)](https://github.com/remarkablemark/inline-style-parser/actions/workflows/build.yml)
+[![codecov](https://codecov.io/gh/remarkablemark/inline-style-parser/branch/master/graph/badge.svg?token=B8EEK5709W)](https://codecov.io/gh/remarkablemark/inline-style-parser)
+[![NPM downloads](https://img.shields.io/npm/dm/inline-style-parser)](https://www.npmjs.com/package/inline-style-parser)
+
+Inline style parser copied from [`css/lib/parse/index.js`](https://github.com/reworkcss/css/blob/v2.2.4/lib/parse/index.js):
+
+```
+InlineStyleParser(string)
+```
+
+Example:
+
+```js
+const parse = require('inline-style-parser');
+
+parse('color: #BADA55;');
+```
+
+Output:
+
+```js
+[ { type: 'declaration',
+    property: 'color',
+    value: '#BADA55',
+    position: Position { start: [Object], end: [Object], source: undefined } } ]
+```
+
+[JSFiddle](https://jsfiddle.net/remarkablemark/hcxbpwq8/) | [Examples](https://github.com/remarkablemark/inline-style-parser/tree/master/examples)
+
+## Installation
+
+[NPM](https://www.npmjs.com/package/inline-style-parser):
+
+```sh
+npm install inline-style-parser --save
+```
+
+[Yarn](https://yarnpkg.com/package/inline-style-parser):
+
+```sh
+yarn add inline-style-parser
+```
+
+[CDN](https://unpkg.com/inline-style-parser/):
+
+```html
+<script src="https://unpkg.com/inline-style-parser@latest/dist/inline-style-parser.min.js"></script>
+<script>
+  window.InlineStyleParser(/* string */);
+</script>
+```
+
+## Usage
+
+Import with ES Modules:
+
+```js
+import parse from 'inline-style-parser';
+```
+
+Or require with CommonJS:
+
+```js
+const parse = require('inline-style-parser');
+```
+
+Parse single declaration:
+
+```js
+parse('left: 0');
+```
+
+Output:
+
+```js
+[
+  {
+    type: 'declaration',
+    property: 'left',
+    value: '0',
+    position: {
+      start: { line: 1, column: 1 },
+      end: { line: 1, column: 8 },
+      source: undefined
+    }
+  }
+]
+```
+
+Parse multiple declarations:
+
+```js
+parse('left: 0; right: 100px;');
+```
+
+Output:
+
+```js
+[
+  {
+    type: 'declaration',
+    property: 'left',
+    value: '0',
+    position: {
+      start: { line: 1, column: 1 },
+      end: { line: 1, column: 8 },
+      source: undefined
+    }
+  },
+  {
+    type: 'declaration',
+    property: 'right',
+    value: '100px',
+    position: {
+      start: { line: 1, column: 10 },
+      end: { line: 1, column: 22 },
+      source: undefined
+    }
+  }
+]
+```
+
+Parse declaration with missing value:
+
+```js
+parse('top:');
+```
+
+Output:
+
+```js
+[
+  {
+    type: 'declaration',
+    property: 'top',
+    value: '',
+    position: {
+      start: { line: 1, column: 1 },
+      end: { line: 1, column: 5 },
+      source: undefined
+    }
+  }
+]
+```
+
+Parse unknown declaration:
+
+```js
+parse('answer: 42;');
+```
+
+Output:
+
+```js
+[
+  {
+    type: 'declaration',
+    property: 'answer',
+    value: '42',
+    position: {
+      start: { line: 1, column: 1 },
+      end: { line: 1, column: 11 },
+      source: undefined
+    }
+  }
+]
+```
+
+Invalid declarations:
+
+```js
+parse('');      // []
+parse();        // throws TypeError
+parse(1);       // throws TypeError
+parse('width'); // throws Error
+parse('/*');    // throws Error
+```
+
+## Testing
+
+Run tests:
+
+```sh
+npm test
+```
+
+Run tests in watch mode:
+
+```sh
+npm run test:watch
+```
+
+Run tests with coverage:
+
+```sh
+npm run test:coverage
+```
+
+Run tests in CI mode:
+
+```sh
+npm run test:ci
+```
+
+Lint files:
+
+```sh
+npm run lint
+```
+
+Fix lint errors:
+
+```sh
+npm run lint:fix
+```
+
+## Release
+
+Release and publish are automated by [Release Please](https://github.com/googleapis/release-please).
+
+## License
+
+[MIT](https://github.com/remarkablemark/inline-style-parser/blob/master/LICENSE). See the [license](https://github.com/reworkcss/css/blob/v2.2.4/LICENSE) from the original project.