feat: Phase 1 — extract the client (web SPA + desktop) to dtoro/oikos-web

Problem: the hexagonal refactor churns the backend tree for nine more
phases; the UI delivery stack (web/ SPA, cmd/desktop Wails wrapper,
compose/web image) must move to its own repo first so doc/layout
rewrites land once on a backend-only tree.

Change:
- New repo git.hubris.network/dtoro/oikos-web (v0.33.0): web/, desktop/
  (updateURL repointed to oikos-web releases), compose/, own CI (web +
  desktop jobs), own deploy script (CI-green gate, TOCTOU guard,
  version-tagged images, prune-to-3), own webhook receiver on :9798 +
  launchd unit, own compose project publishing the same 8091:80.
- Cutover executed on mac-mini in order: oikos stack's web service
  stopped+removed, oikos-web project brought up on 8091; outer Caddy
  untouched (targets the published port) — serving + Authentik flow +
  /wails 404 quirk verified post-cutover.
- Stripped from oikos: web/, cmd/desktop/, compose/web/, desktop CI
  workflow, ci.yml web job, Makefile ui/desktop/desktop-package/install
  targets, the compose web service, oikos-web from deploy.sh's fallback
  prune list; wails + go-keyring dropped from go.mod, vendor synced.
- README / CONTRIBUTING / AGENTS.md / .agents dev+operations docs now
  point at the new repo; mbse + mascot design docs carry a path note.

Risk: production SPA serving depends on the new pipeline now; rollback
is versioned-image re-up of the old web service from a pre-split
checkout (port 8091). Desktop builds installed before the split still
check dtoro/oikos releases — one manual reinstall, noted in the
oikos-web release notes.

Verification: go vet, make test (race), make generate-check, golangci
(no new findings; baseline down 400→365); post-cutover curls —
localhost:8091 200, /wails/runtime.js 404, outer Caddy 302 Authentik.

web/node_modules/postcss/lib/result.d.ts

@@ -0,0 +1,204 @@
+import {
+  Document,
+  Node,
+  Plugin,
+  ProcessOptions,
+  Root,
+  SourceMap,
+  TransformCallback,
+  Warning,
+  WarningOptions
+} from './postcss.js'
+import Processor from './processor.js'
+
+declare namespace Result {
+  export interface Message {
+    [others: string]: any
+
+    /**
+     * Source PostCSS plugin name.
+     */
+    plugin?: string
+
+    /**
+     * Message type.
+     */
+    type: string
+  }
+
+  export interface ResultOptions extends ProcessOptions {
+    /**
+     * The CSS node that was the source of the warning.
+     */
+    node?: Node
+
+    /**
+     * Name of plugin that created this warning. `Result#warn` will fill it
+     * automatically with `Plugin#postcssPlugin` value.
+     */
+    plugin?: string
+  }
+
+  export { Result_ as default }
+}
+
+/**
+ * Provides the result of the PostCSS transformations.
+ *
+ * A Result instance is returned by `LazyResult#then`
+ * or `Root#toResult` methods.
+ *
+ * ```js
+ * postcss([autoprefixer]).process(css).then(result => {
+ *  console.log(result.css)
+ * })
+ * ```
+ *
+ * ```js
+ * const result2 = postcss.parse(css).toResult()
+ * ```
+ */
+declare class Result_<RootNode = Document | Root> {
+  /**
+   * A CSS string representing of `Result#root`.
+   *
+   * ```js
+   * postcss.parse('a{}').toResult().css //=> "a{}"
+   * ```
+   */
+  css: string
+
+  /**
+   * Last runned PostCSS plugin.
+   */
+  lastPlugin: Plugin | TransformCallback
+
+  /**
+   * An instance of `SourceMapGenerator` class from the `source-map` library,
+   * representing changes to the `Result#root` instance.
+   *
+   * ```js
+   * result.map.toJSON() //=> { version: 3, file: 'a.css', … }
+   * ```
+   *
+   * ```js
+   * if (result.map) {
+   *   fs.writeFileSync(result.opts.to + '.map', result.map.toString())
+   * }
+   * ```
+   */
+  map: SourceMap
+
+  /**
+   * Contains messages from plugins (e.g., warnings or custom messages).
+   * Each message should have type and plugin properties.
+   *
+   * ```js
+   * AtRule: {
+   *   import: (atRule, { result }) {
+   *     const importedFile = parseImport(atRule)
+   *     result.messages.push({
+   *       type: 'dependency',
+   *       plugin: 'postcss-import',
+   *       file: importedFile,
+   *       parent: result.opts.from
+   *     })
+   *   }
+   * }
+   * ```
+   */
+  messages: Result.Message[]
+
+  /**
+   * Options from the `Processor#process` or `Root#toResult` call
+   * that produced this Result instance.]
+   *
+   * ```js
+   * root.toResult(opts).opts === opts
+   * ```
+   */
+  opts: Result.ResultOptions
+
+  /**
+   * The Processor instance used for this transformation.
+   *
+   * ```js
+   * for (const plugin of result.processor.plugins) {
+   *   if (plugin.postcssPlugin === 'postcss-bad') {
+   *     throw 'postcss-good is incompatible with postcss-bad'
+   *   }
+   * })
+   * ```
+   */
+  processor: Processor
+
+  /**
+   * Root node after all transformations.
+   *
+   * ```js
+   * root.toResult().root === root
+   * ```
+   */
+  root: RootNode
+
+  /**
+   * An alias for the `Result#css` property.
+   * Use it with syntaxes that generate non-CSS output.
+   *
+   * ```js
+   * result.css === result.content
+   * ```
+   */
+  get content(): string
+
+  /**
+   * @param processor Processor used for this transformation.
+   * @param root      Root node after all transformations.
+   * @param opts      Options from the `Processor#process` or `Root#toResult`.
+   */
+  constructor(processor: Processor, root: RootNode, opts: Result.ResultOptions)
+
+  /**
+   * Returns for `Result#css` content.
+   *
+   * ```js
+   * result + '' === result.css
+   * ```
+   *
+   * @return String representing of `Result#root`.
+   */
+  toString(): string
+
+  /**
+   * Creates an instance of `Warning` and adds it to `Result#messages`.
+   *
+   * ```js
+   * if (decl.important) {
+   *   result.warn('Avoid !important', { node: decl, word: '!important' })
+   * }
+   * ```
+   *
+   * @param text Warning message.
+   * @param opts Warning options.
+   * @return Created warning.
+   */
+  warn(message: string, options?: WarningOptions): Warning
+
+  /**
+   * Returns warnings from plugins. Filters `Warning` instances
+   * from `Result#messages`.
+   *
+   * ```js
+   * result.warnings().forEach(warn => {
+   *   console.warn(warn.toString())
+   * })
+   * ```
+   *
+   * @return Warnings from plugins.
+   */
+  warnings(): Warning[]
+}
+
+declare class Result<RootNode = Document | Root> extends Result_<RootNode> {}
+
+export = Result