feat: Phase 1 — extract the client (web SPA + desktop) to dtoro/oikos-web

Problem: the hexagonal refactor churns the backend tree for nine more
phases; the UI delivery stack (web/ SPA, cmd/desktop Wails wrapper,
compose/web image) must move to its own repo first so doc/layout
rewrites land once on a backend-only tree.

Change:
- New repo git.hubris.network/dtoro/oikos-web (v0.33.0): web/, desktop/
  (updateURL repointed to oikos-web releases), compose/, own CI (web +
  desktop jobs), own deploy script (CI-green gate, TOCTOU guard,
  version-tagged images, prune-to-3), own webhook receiver on :9798 +
  launchd unit, own compose project publishing the same 8091:80.
- Cutover executed on mac-mini in order: oikos stack's web service
  stopped+removed, oikos-web project brought up on 8091; outer Caddy
  untouched (targets the published port) — serving + Authentik flow +
  /wails 404 quirk verified post-cutover.
- Stripped from oikos: web/, cmd/desktop/, compose/web/, desktop CI
  workflow, ci.yml web job, Makefile ui/desktop/desktop-package/install
  targets, the compose web service, oikos-web from deploy.sh's fallback
  prune list; wails + go-keyring dropped from go.mod, vendor synced.
- README / CONTRIBUTING / AGENTS.md / .agents dev+operations docs now
  point at the new repo; mbse + mascot design docs carry a path note.

Risk: production SPA serving depends on the new pipeline now; rollback
is versioned-image re-up of the old web service from a pre-split
checkout (port 8091). Desktop builds installed before the split still
check dtoro/oikos releases — one manual reinstall, noted in the
oikos-web release notes.

Verification: go vet, make test (race), make generate-check, golangci
(no new findings; baseline down 400→365); post-cutover curls —
localhost:8091 200, /wails/runtime.js 404, outer Caddy 302 Authentik.

web/node_modules/json-stable-stringify-without-jsonify/.npmignore

@@ -0,0 +1 @@
+node_modules

web/node_modules/json-stable-stringify-without-jsonify/.travis.yml

@@ -0,0 +1,4 @@
+language: node_js
+node_js:
+  - "0.8"
+  - "0.10"

web/node_modules/json-stable-stringify-without-jsonify/LICENSE

@@ -0,0 +1,18 @@
+This software is released under the MIT license:
+
+Permission is hereby granted, free of charge, to any person obtaining a copy of
+this software and associated documentation files (the "Software"), to deal in
+the Software without restriction, including without limitation the rights to
+use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of
+the Software, and to permit persons to whom the Software is furnished to do so,
+subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS
+FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR
+COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER
+IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN
+CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.

web/node_modules/json-stable-stringify-without-jsonify/example/key_cmp.js

@@ -0,0 +1,7 @@
+var stringify = require('../');
+
+var obj = { c: 8, b: [{z:6,y:5,x:4},7], a: 3 };
+var s = stringify(obj, function (a, b) {
+    return a.key < b.key ? 1 : -1;
+});
+console.log(s);

web/node_modules/json-stable-stringify-without-jsonify/example/nested.js

@@ -0,0 +1,3 @@
+var stringify = require('../');
+var obj = { c: 8, b: [{z:6,y:5,x:4},7], a: 3 };
+console.log(stringify(obj));

web/node_modules/json-stable-stringify-without-jsonify/example/str.js

@@ -0,0 +1,3 @@
+var stringify = require('../');
+var obj = { c: 6, b: [4,5], a: 3 };
+console.log(stringify(obj));

web/node_modules/json-stable-stringify-without-jsonify/example/value_cmp.js

@@ -0,0 +1,7 @@
+var stringify = require('../');
+
+var obj = { d: 6, c: 5, b: [{z:3,y:2,x:1},9], a: 10 };
+var s = stringify(obj, function (a, b) {
+    return a.value < b.value ? 1 : -1;
+});
+console.log(s);

web/node_modules/json-stable-stringify-without-jsonify/index.js

@@ -0,0 +1,82 @@
+module.exports = function (obj, opts) {
+    if (!opts) opts = {};
+    if (typeof opts === 'function') opts = { cmp: opts };
+    var space = opts.space || '';
+    if (typeof space === 'number') space = Array(space+1).join(' ');
+    var cycles = (typeof opts.cycles === 'boolean') ? opts.cycles : false;
+    var replacer = opts.replacer || function(key, value) { return value; };
+
+    var cmp = opts.cmp && (function (f) {
+        return function (node) {
+            return function (a, b) {
+                var aobj = { key: a, value: node[a] };
+                var bobj = { key: b, value: node[b] };
+                return f(aobj, bobj);
+            };
+        };
+    })(opts.cmp);
+
+    var seen = [];
+    return (function stringify (parent, key, node, level) {
+        var indent = space ? ('\n' + new Array(level + 1).join(space)) : '';
+        var colonSeparator = space ? ': ' : ':';
+
+        if (node && node.toJSON && typeof node.toJSON === 'function') {
+            node = node.toJSON();
+        }
+
+        node = replacer.call(parent, key, node);
+
+        if (node === undefined) {
+            return;
+        }
+        if (typeof node !== 'object' || node === null) {
+            return JSON.stringify(node);
+        }
+        if (isArray(node)) {
+            var out = [];
+            for (var i = 0; i < node.length; i++) {
+                var item = stringify(node, i, node[i], level+1) || JSON.stringify(null);
+                out.push(indent + space + item);
+            }
+            return '[' + out.join(',') + indent + ']';
+        }
+        else {
+            if (seen.indexOf(node) !== -1) {
+                if (cycles) return JSON.stringify('__cycle__');
+                throw new TypeError('Converting circular structure to JSON');
+            }
+            else seen.push(node);
+
+            var keys = objectKeys(node).sort(cmp && cmp(node));
+            var out = [];
+            for (var i = 0; i < keys.length; i++) {
+                var key = keys[i];
+                var value = stringify(node, key, node[key], level+1);
+
+                if(!value) continue;
+
+                var keyValue = JSON.stringify(key)
+                    + colonSeparator
+                    + value;
+                ;
+                out.push(indent + space + keyValue);
+            }
+            seen.splice(seen.indexOf(node), 1);
+            return '{' + out.join(',') + indent + '}';
+        }
+    })({ '': obj }, '', obj, 0);
+};
+
+var isArray = Array.isArray || function (x) {
+    return {}.toString.call(x) === '[object Array]';
+};
+
+var objectKeys = Object.keys || function (obj) {
+    var has = Object.prototype.hasOwnProperty || function () { return true };
+    var keys = [];
+    for (var key in obj) {
+        if (has.call(obj, key)) keys.push(key);
+    }
+    return keys;
+};

web/node_modules/json-stable-stringify-without-jsonify/package.json

@@ -0,0 +1,43 @@
+{
+  "name": "json-stable-stringify-without-jsonify",
+  "version": "1.0.1",
+  "description": "deterministic JSON.stringify() with custom sorting to get deterministic hashes from stringified results, with no public domain dependencies",
+  "main": "index.js",
+  "dependencies": {
+  },
+  "devDependencies": {
+    "tape": "~1.0.4"
+  },
+  "scripts": {
+    "test": "tape test/*.js"
+  },
+  "testling": {
+    "files": "test/*.js",
+    "browsers": [
+      "ie/8..latest",
+      "ff/5", "ff/latest",
+      "chrome/15", "chrome/latest",
+      "safari/latest",
+      "opera/latest"
+    ]
+  },
+  "repository": {
+    "type": "git",
+    "url": "git://github.com/samn/json-stable-stringify.git"
+  },
+  "homepage": "https://github.com/samn/json-stable-stringify",
+  "keywords": [
+    "json",
+    "stringify",
+    "deterministic",
+    "hash",
+    "sort",
+    "stable"
+  ],
+  "author": {
+    "name": "James Halliday",
+    "email": "mail@substack.net",
+    "url": "http://substack.net"
+  },
+  "license": "MIT"
+}

web/node_modules/json-stable-stringify-without-jsonify/readme.markdown

@@ -0,0 +1,132 @@
+# json-stable-stringify
+
+This is the same as https://github.com/substack/json-stable-stringify but it doesn't depend on libraries without licenses (jsonify).
+
+deterministic version of `JSON.stringify()` so you can get a consistent hash
+from stringified results
+
+You can also pass in a custom comparison function.
+
+[![browser support](https://ci.testling.com/substack/json-stable-stringify.png)](https://ci.testling.com/substack/json-stable-stringify)
+
+[![build status](https://secure.travis-ci.org/substack/json-stable-stringify.png)](http://travis-ci.org/substack/json-stable-stringify)
+
+# example
+
+``` js
+var stringify = require('json-stable-stringify');
+var obj = { c: 8, b: [{z:6,y:5,x:4},7], a: 3 };
+console.log(stringify(obj));
+```
+
+output:
+
+```
+{"a":3,"b":[{"x":4,"y":5,"z":6},7],"c":8}
+```
+
+# methods
+
+``` js
+var stringify = require('json-stable-stringify')
+```
+
+## var str = stringify(obj, opts)
+
+Return a deterministic stringified string `str` from the object `obj`.
+
+## options
+
+### cmp
+
+If `opts` is given, you can supply an `opts.cmp` to have a custom comparison
+function for object keys. Your function `opts.cmp` is called with these
+parameters:
+
+``` js
+opts.cmp({ key: akey, value: avalue }, { key: bkey, value: bvalue })
+```
+
+For example, to sort on the object key names in reverse order you could write:
+
+``` js
+var stringify = require('json-stable-stringify');
+
+var obj = { c: 8, b: [{z:6,y:5,x:4},7], a: 3 };
+var s = stringify(obj, function (a, b) {
+    return a.key < b.key ? 1 : -1;
+});
+console.log(s);
+```
+
+which results in the output string:
+
+```
+{"c":8,"b":[{"z":6,"y":5,"x":4},7],"a":3}
+```
+
+Or if you wanted to sort on the object values in reverse order, you could write:
+
+```
+var stringify = require('json-stable-stringify');
+
+var obj = { d: 6, c: 5, b: [{z:3,y:2,x:1},9], a: 10 };
+var s = stringify(obj, function (a, b) {
+    return a.value < b.value ? 1 : -1;
+});
+console.log(s);
+```
+
+which outputs:
+
+```
+{"d":6,"c":5,"b":[{"z":3,"y":2,"x":1},9],"a":10}
+```
+
+### space
+
+If you specify `opts.space`, it will indent the output for pretty-printing.
+Valid values are strings (e.g. `{space: \t}`) or a number of spaces
+(`{space: 3}`).
+
+For example:
+
+```js
+var obj = { b: 1, a: { foo: 'bar', and: [1, 2, 3] } };
+var s = stringify(obj, { space: '  ' });
+console.log(s);
+```
+
+which outputs:
+
+```
+{
+  "a": {
+    "and": [
+      1,
+      2,
+      3
+    ],
+    "foo": "bar"
+  },
+  "b": 1
+}
+```
+
+### replacer
+
+The replacer parameter is a function `opts.replacer(key, value)` that behaves
+the same as the replacer
+[from the core JSON object](https://developer.mozilla.org/en-US/docs/Web/JavaScript/Guide/Using_native_JSON#The_replacer_parameter).
+
+# install
+
+With [npm](https://npmjs.org) do:
+
+```
+npm install json-stable-stringify
+```
+
+# license
+
+MIT

web/node_modules/json-stable-stringify-without-jsonify/test/cmp.js

@@ -0,0 +1,11 @@
+var test = require('tape');
+var stringify = require('../');
+
+test('custom comparison function', function (t) {
+    t.plan(1);
+    var obj = { c: 8, b: [{z:6,y:5,x:4},7], a: 3 };
+    var s = stringify(obj, function (a, b) {
+        return a.key < b.key ? 1 : -1;
+    });
+    t.equal(s, '{"c":8,"b":[{"z":6,"y":5,"x":4},7],"a":3}');
+});

web/node_modules/json-stable-stringify-without-jsonify/test/nested.js

@@ -0,0 +1,42 @@
+var test = require('tape');
+var stringify = require('../');
+
+test('nested', function (t) {
+    t.plan(1);
+    var obj = { c: 8, b: [{z:6,y:5,x:4},7], a: 3 };
+    t.equal(stringify(obj), '{"a":3,"b":[{"x":4,"y":5,"z":6},7],"c":8}');
+});
+
+test('cyclic (default)', function (t) {
+    t.plan(1);
+    var one = { a: 1 };
+    var two = { a: 2, one: one };
+    one.two = two;
+    try {
+    	stringify(one);
+    } catch (ex) {
+    	t.equal(ex.toString(), 'TypeError: Converting circular structure to JSON');
+    }
+});
+
+test('cyclic (specifically allowed)', function (t) {
+    t.plan(1);
+    var one = { a: 1 };
+    var two = { a: 2, one: one };
+    one.two = two;
+    t.equal(stringify(one, {cycles:true}), '{"a":1,"two":{"a":2,"one":"__cycle__"}}');
+});
+
+test('repeated non-cyclic value', function(t) {
+    t.plan(1);
+    var one = { x: 1 };
+    var two = { a: one, b: one };
+    t.equal(stringify(two), '{"a":{"x":1},"b":{"x":1}}');
+});
+
+test('acyclic but with reused obj-property pointers', function (t) {
+    t.plan(1);
+    var x = { a: 1 }
+    var y = { b: x, c: x }
+    t.equal(stringify(y), '{"b":{"a":1},"c":{"a":1}}');
+});

web/node_modules/json-stable-stringify-without-jsonify/test/replacer.js

@@ -0,0 +1,74 @@
+var test = require('tape');
+var stringify = require('../');
+
+test('replace root', function (t) {
+	t.plan(1);
+
+	var obj = { a: 1, b: 2, c: false };
+	var replacer = function(key, value) { return 'one'; };
+
+	t.equal(stringify(obj, { replacer: replacer }), '"one"');
+});
+
+test('replace numbers', function (t) {
+	t.plan(1);
+
+	var obj = { a: 1, b: 2, c: false };
+	var replacer = function(key, value) {
+		if(value === 1) return 'one';
+		if(value === 2) return 'two';
+		return value;
+	};
+
+	t.equal(stringify(obj, { replacer: replacer }), '{"a":"one","b":"two","c":false}');
+});
+
+test('replace with object', function (t) {
+	t.plan(1);
+
+	var obj = { a: 1, b: 2, c: false };
+	var replacer = function(key, value) {
+		if(key === 'b') return { d: 1 };
+		if(value === 1) return 'one';
+		return value;
+	};
+
+	t.equal(stringify(obj, { replacer: replacer }), '{"a":"one","b":{"d":"one"},"c":false}');
+});
+
+test('replace with undefined', function (t) {
+	t.plan(1);
+
+	var obj = { a: 1, b: 2, c: false };
+	var replacer = function(key, value) {
+		if(value === false) return;
+		return value;
+	};
+
+	t.equal(stringify(obj, { replacer: replacer }), '{"a":1,"b":2}');
+});
+
+test('replace with array', function (t) {
+	t.plan(1);
+
+	var obj = { a: 1, b: 2, c: false };
+	var replacer = function(key, value) {
+		if(key === 'b') return ['one', 'two'];
+		return value;
+	};
+
+	t.equal(stringify(obj, { replacer: replacer }), '{"a":1,"b":["one","two"],"c":false}');
+});
+
+test('replace array item', function (t) {
+	t.plan(1);
+
+	var obj = { a: 1, b: 2, c: [1,2] };
+	var replacer = function(key, value) {
+		if(value === 1) return 'one';
+		if(value === 2) return 'two';
+		return value;
+	};
+
+	t.equal(stringify(obj, { replacer: replacer }), '{"a":"one","b":"two","c":["one","two"]}');
+});

web/node_modules/json-stable-stringify-without-jsonify/test/space.js

@@ -0,0 +1,59 @@
+var test = require('tape');
+var stringify = require('../');
+
+test('space parameter', function (t) {
+    t.plan(1);
+    var obj = { one: 1, two: 2 };
+    t.equal(stringify(obj, {space: '  '}), ''
+        + '{\n'
+        + '  "one": 1,\n'
+        + '  "two": 2\n'
+        + '}'
+    );
+});
+
+test('space parameter (with tabs)', function (t) {
+    t.plan(1);
+    var obj = { one: 1, two: 2 };
+    t.equal(stringify(obj, {space: '\t'}), ''
+        + '{\n'
+        + '\t"one": 1,\n'
+        + '\t"two": 2\n'
+        + '}'
+    );
+});
+
+test('space parameter (with a number)', function (t) {
+    t.plan(1);
+    var obj = { one: 1, two: 2 };
+    t.equal(stringify(obj, {space: 3}), ''
+        + '{\n'
+        + '   "one": 1,\n'
+        + '   "two": 2\n'
+        + '}'
+    );
+});
+
+test('space parameter (nested objects)', function (t) {
+    t.plan(1);
+    var obj = { one: 1, two: { b: 4, a: [2,3] } };
+    t.equal(stringify(obj, {space: '  '}), ''
+        + '{\n'
+        + '  "one": 1,\n'
+        + '  "two": {\n'
+        + '    "a": [\n'
+        + '      2,\n'
+        + '      3\n'
+        + '    ],\n'
+        + '    "b": 4\n'
+        + '  }\n'
+        + '}'
+    );
+});
+
+test('space parameter (same as native)', function (t) {
+    t.plan(1);
+    // for this test, properties need to be in alphabetical order
+    var obj = { one: 1, two: { a: [2,3], b: 4 } };
+    t.equal(stringify(obj, {space: '  '}), JSON.stringify(obj, null, '  '));
+});

web/node_modules/json-stable-stringify-without-jsonify/test/str.js

@@ -0,0 +1,32 @@
+var test = require('tape');
+var stringify = require('../');
+
+test('simple object', function (t) {
+    t.plan(1);
+    var obj = { c: 6, b: [4,5], a: 3, z: null };
+    t.equal(stringify(obj), '{"a":3,"b":[4,5],"c":6,"z":null}');
+});
+
+test('object with undefined', function (t) {
+	t.plan(1);
+	var obj = { a: 3, z: undefined };
+	t.equal(stringify(obj), '{"a":3}');
+});
+
+test('array with undefined', function (t) {
+	t.plan(1);
+	var obj = [4, undefined, 6];
+	t.equal(stringify(obj), '[4,null,6]');
+});
+
+test('object with empty string', function (t) {
+	t.plan(1);
+	var obj = { a: 3, z: '' };
+	t.equal(stringify(obj), '{"a":3,"z":""}');
+});
+
+test('array with empty string', function (t) {
+	t.plan(1);
+	var obj = [4, '', 6];
+	t.equal(stringify(obj), '[4,"",6]');
+});

web/node_modules/json-stable-stringify-without-jsonify/test/to-json.js

@@ -0,0 +1,20 @@
+var test = require('tape');
+var stringify = require('../');
+
+test('toJSON function', function (t) {
+    t.plan(1);
+    var obj = { one: 1, two: 2, toJSON: function() { return { one: 1 }; } };
+    t.equal(stringify(obj), '{"one":1}' );
+});
+
+test('toJSON returns string', function (t) {
+	t.plan(1);
+	var obj = { one: 1, two: 2, toJSON: function() { return 'one'; } };
+	t.equal(stringify(obj), '"one"');
+});
+
+test('toJSON returns array', function (t) {
+	t.plan(1);
+	var obj = { one: 1, two: 2, toJSON: function() { return ['one']; } };
+	t.equal(stringify(obj), '["one"]');
+});