feat: Phase 1 — extract the client (web SPA + desktop) to dtoro/oikos-web

Problem: the hexagonal refactor churns the backend tree for nine more
phases; the UI delivery stack (web/ SPA, cmd/desktop Wails wrapper,
compose/web image) must move to its own repo first so doc/layout
rewrites land once on a backend-only tree.

Change:
- New repo git.hubris.network/dtoro/oikos-web (v0.33.0): web/, desktop/
  (updateURL repointed to oikos-web releases), compose/, own CI (web +
  desktop jobs), own deploy script (CI-green gate, TOCTOU guard,
  version-tagged images, prune-to-3), own webhook receiver on :9798 +
  launchd unit, own compose project publishing the same 8091:80.
- Cutover executed on mac-mini in order: oikos stack's web service
  stopped+removed, oikos-web project brought up on 8091; outer Caddy
  untouched (targets the published port) — serving + Authentik flow +
  /wails 404 quirk verified post-cutover.
- Stripped from oikos: web/, cmd/desktop/, compose/web/, desktop CI
  workflow, ci.yml web job, Makefile ui/desktop/desktop-package/install
  targets, the compose web service, oikos-web from deploy.sh's fallback
  prune list; wails + go-keyring dropped from go.mod, vendor synced.
- README / CONTRIBUTING / AGENTS.md / .agents dev+operations docs now
  point at the new repo; mbse + mascot design docs carry a path note.

Risk: production SPA serving depends on the new pipeline now; rollback
is versioned-image re-up of the old web service from a pre-split
checkout (port 8091). Desktop builds installed before the split still
check dtoro/oikos releases — one manual reinstall, noted in the
oikos-web release notes.

Verification: go vet, make test (race), make generate-check, golangci
(no new findings; baseline down 400→365); post-cutover curls —
localhost:8091 200, /wails/runtime.js 404, outer Caddy 302 Authentik.

web/node_modules/parse5/dist/cjs/common/token.d.ts

@@ -0,0 +1,84 @@
+import type { TAG_ID } from './html.js';
+export declare enum TokenType {
+    CHARACTER = 0,
+    NULL_CHARACTER = 1,
+    WHITESPACE_CHARACTER = 2,
+    START_TAG = 3,
+    END_TAG = 4,
+    COMMENT = 5,
+    DOCTYPE = 6,
+    EOF = 7,
+    HIBERNATION = 8
+}
+export interface Location {
+    /** One-based line index of the first character. */
+    startLine: number;
+    /** One-based column index of the first character. */
+    startCol: number;
+    /** Zero-based first character index. */
+    startOffset: number;
+    /** One-based line index of the last character. */
+    endLine: number;
+    /** One-based column index of the last character. Points directly *after* the last character. */
+    endCol: number;
+    /** Zero-based last character index. Points directly *after* the last character. */
+    endOffset: number;
+}
+export interface LocationWithAttributes extends Location {
+    /** Start tag attributes' location info. */
+    attrs?: Record<string, Location>;
+}
+export interface ElementLocation extends LocationWithAttributes {
+    /** Element's start tag location info. */
+    startTag?: Location;
+    /**
+     * Element's end tag location info.
+     * This property is undefined, if the element has no closing tag.
+     */
+    endTag?: Location;
+}
+interface TokenBase {
+    readonly type: TokenType;
+    location: Location | null;
+}
+export interface DoctypeToken extends TokenBase {
+    readonly type: TokenType.DOCTYPE;
+    name: string | null;
+    forceQuirks: boolean;
+    publicId: string | null;
+    systemId: string | null;
+}
+export interface Attribute {
+    /** The name of the attribute. */
+    name: string;
+    /** The namespace of the attribute. */
+    namespace?: string;
+    /** The namespace-related prefix of the attribute. */
+    prefix?: string;
+    /** The value of the attribute. */
+    value: string;
+}
+export interface TagToken extends TokenBase {
+    readonly type: TokenType.START_TAG | TokenType.END_TAG;
+    tagName: string;
+    /** Used to cache the ID of the tag name. */
+    tagID: TAG_ID;
+    selfClosing: boolean;
+    ackSelfClosing: boolean;
+    attrs: Attribute[];
+    location: LocationWithAttributes | null;
+}
+export declare function getTokenAttr(token: TagToken, attrName: string): string | null;
+export interface CommentToken extends TokenBase {
+    readonly type: TokenType.COMMENT;
+    data: string;
+}
+export interface EOFToken extends TokenBase {
+    readonly type: TokenType.EOF;
+}
+export interface CharacterToken extends TokenBase {
+    type: TokenType.CHARACTER | TokenType.NULL_CHARACTER | TokenType.WHITESPACE_CHARACTER;
+    chars: string;
+}
+export type Token = DoctypeToken | TagToken | CommentToken | EOFToken | CharacterToken;
+export {};