feat: Phase 1 — extract the client (web SPA + desktop) to dtoro/oikos-web

Problem: the hexagonal refactor churns the backend tree for nine more
phases; the UI delivery stack (web/ SPA, cmd/desktop Wails wrapper,
compose/web image) must move to its own repo first so doc/layout
rewrites land once on a backend-only tree.

Change:
- New repo git.hubris.network/dtoro/oikos-web (v0.33.0): web/, desktop/
  (updateURL repointed to oikos-web releases), compose/, own CI (web +
  desktop jobs), own deploy script (CI-green gate, TOCTOU guard,
  version-tagged images, prune-to-3), own webhook receiver on :9798 +
  launchd unit, own compose project publishing the same 8091:80.
- Cutover executed on mac-mini in order: oikos stack's web service
  stopped+removed, oikos-web project brought up on 8091; outer Caddy
  untouched (targets the published port) — serving + Authentik flow +
  /wails 404 quirk verified post-cutover.
- Stripped from oikos: web/, cmd/desktop/, compose/web/, desktop CI
  workflow, ci.yml web job, Makefile ui/desktop/desktop-package/install
  targets, the compose web service, oikos-web from deploy.sh's fallback
  prune list; wails + go-keyring dropped from go.mod, vendor synced.
- README / CONTRIBUTING / AGENTS.md / .agents dev+operations docs now
  point at the new repo; mbse + mascot design docs carry a path note.

Risk: production SPA serving depends on the new pipeline now; rollback
is versioned-image re-up of the old web service from a pre-split
checkout (port 8091). Desktop builds installed before the split still
check dtoro/oikos releases — one manual reinstall, noted in the
oikos-web release notes.

Verification: go vet, make test (race), make generate-check, golangci
(no new findings; baseline down 400→365); post-cutover curls —
localhost:8091 200, /wails/runtime.js 404, outer Caddy 302 Authentik.

web/node_modules/marked/man/marked.1.md

@@ -0,0 +1,93 @@
+# marked(1) -- a javascript markdown parser
+
+## SYNOPSIS
+
+`marked` [`-o` <output file>] [`-i` <input file>] [`-s` <markdown string>] [`-c` <config file>] [`--help`] [`--version`] [`--tokens`] [`--no-clobber`] [`--pedantic`] [`--gfm`] [`--breaks`] [`--no-etc...`] [`--silent`] [filename]
+
+## DESCRIPTION
+
+marked is a full-featured javascript markdown parser, built for speed.
+It also includes multiple GFM features.
+
+## EXAMPLES
+
+```sh
+cat in.md | marked > out.html
+```
+
+```sh
+echo "hello *world*" | marked
+```
+
+```sh
+marked -o out.html -i in.md --gfm
+```
+
+```sh
+marked --output="hello world.html" -i in.md --no-breaks
+```
+
+## OPTIONS
+
+* -o, --output [output file]
+Specify file output. If none is specified, write to stdout.
+
+* -i, --input [input file]
+Specify file input, otherwise use last argument as input file.
+If no input file is specified, read from stdin.
+
+* -s, --string [markdown string]
+Specify string input instead of a file.
+
+* -c, --config [config file]
+Specify config file to use instead of the default `~/.marked.json` or `~/.marked.js` or `~/.marked/index.js`.
+
+* -t, --tokens
+Output a token list instead of html.
+
+* -n, --no-clobber
+Do not overwrite `output` if it exists.
+
+* --pedantic
+Conform to obscure parts of markdown.pl as much as possible.
+Don't fix original markdown bugs.
+
+* --gfm
+Enable github flavored markdown.
+
+* --breaks
+Enable GFM line breaks. Only works with the gfm option.
+
+* --no-breaks, -no-etc...
+The inverse of any of the marked options above.
+
+* --silent
+Silence error output.
+
+* -h, --help
+Display help information.
+
+## CONFIGURATION
+
+For configuring and running programmatically.
+
+Example
+
+```js
+import { Marked } from 'marked';
+const marked = new Marked({ gfm: true });
+marked.parse('*foo*');
+```
+
+## BUGS
+
+Please report any bugs to <https://github.com/markedjs/marked>.
+
+## LICENSE
+
+Copyright (c) 2018+, MarkedJS. (MIT License)
+Copyright (c) 2011-2018, Christopher Jeffrey. (MIT License)
+
+## SEE ALSO
+
+markdown(1), nodejs(1)