feat: Phase 1 — extract the client (web SPA + desktop) to dtoro/oikos-web

Problem: the hexagonal refactor churns the backend tree for nine more
phases; the UI delivery stack (web/ SPA, cmd/desktop Wails wrapper,
compose/web image) must move to its own repo first so doc/layout
rewrites land once on a backend-only tree.

Change:
- New repo git.hubris.network/dtoro/oikos-web (v0.33.0): web/, desktop/
  (updateURL repointed to oikos-web releases), compose/, own CI (web +
  desktop jobs), own deploy script (CI-green gate, TOCTOU guard,
  version-tagged images, prune-to-3), own webhook receiver on :9798 +
  launchd unit, own compose project publishing the same 8091:80.
- Cutover executed on mac-mini in order: oikos stack's web service
  stopped+removed, oikos-web project brought up on 8091; outer Caddy
  untouched (targets the published port) — serving + Authentik flow +
  /wails 404 quirk verified post-cutover.
- Stripped from oikos: web/, cmd/desktop/, compose/web/, desktop CI
  workflow, ci.yml web job, Makefile ui/desktop/desktop-package/install
  targets, the compose web service, oikos-web from deploy.sh's fallback
  prune list; wails + go-keyring dropped from go.mod, vendor synced.
- README / CONTRIBUTING / AGENTS.md / .agents dev+operations docs now
  point at the new repo; mbse + mascot design docs carry a path note.

Risk: production SPA serving depends on the new pipeline now; rollback
is versioned-image re-up of the old web service from a pre-split
checkout (port 8091). Desktop builds installed before the split still
check dtoro/oikos releases — one manual reinstall, noted in the
oikos-web release notes.

Verification: go vet, make test (race), make generate-check, golangci
(no new findings; baseline down 400→365); post-cutover curls —
localhost:8091 200, /wails/runtime.js 404, outer Caddy 302 Authentik.

web/node_modules/loupe/lib/html.js

@@ -0,0 +1,42 @@
+import { inspectList, truncator } from './helpers.js';
+export function inspectAttribute([key, value], options) {
+    options.truncate -= 3;
+    if (!value) {
+        return `${options.stylize(String(key), 'yellow')}`;
+    }
+    return `${options.stylize(String(key), 'yellow')}=${options.stylize(`"${value}"`, 'string')}`;
+}
+export function inspectNodeCollection(collection, options) {
+    return inspectList(collection, options, inspectNode, '\n');
+}
+export function inspectNode(node, options) {
+    switch (node.nodeType) {
+        case 1:
+            return inspectHTML(node, options);
+        case 3:
+            return options.inspect(node.data, options);
+        default:
+            return options.inspect(node, options);
+    }
+}
+// @ts-ignore (Deno doesn't have Element)
+export default function inspectHTML(element, options) {
+    const properties = element.getAttributeNames();
+    const name = element.tagName.toLowerCase();
+    const head = options.stylize(`<${name}`, 'special');
+    const headClose = options.stylize(`>`, 'special');
+    const tail = options.stylize(`</${name}>`, 'special');
+    options.truncate -= name.length * 2 + 5;
+    let propertyContents = '';
+    if (properties.length > 0) {
+        propertyContents += ' ';
+        propertyContents += inspectList(properties.map((key) => [key, element.getAttribute(key)]), options, inspectAttribute, ' ');
+    }
+    options.truncate -= propertyContents.length;
+    const truncate = options.truncate;
+    let children = inspectNodeCollection(element.children, options);
+    if (children && children.length > truncate) {
+        children = `${truncator}(${element.children.length})`;
+    }
+    return `${head}${propertyContents}${headClose}${children}${tail}`;
+}