feat: Phase 1 — extract the client (web SPA + desktop) to dtoro/oikos-web

Problem: the hexagonal refactor churns the backend tree for nine more
phases; the UI delivery stack (web/ SPA, cmd/desktop Wails wrapper,
compose/web image) must move to its own repo first so doc/layout
rewrites land once on a backend-only tree.

Change:
- New repo git.hubris.network/dtoro/oikos-web (v0.33.0): web/, desktop/
  (updateURL repointed to oikos-web releases), compose/, own CI (web +
  desktop jobs), own deploy script (CI-green gate, TOCTOU guard,
  version-tagged images, prune-to-3), own webhook receiver on :9798 +
  launchd unit, own compose project publishing the same 8091:80.
- Cutover executed on mac-mini in order: oikos stack's web service
  stopped+removed, oikos-web project brought up on 8091; outer Caddy
  untouched (targets the published port) — serving + Authentik flow +
  /wails 404 quirk verified post-cutover.
- Stripped from oikos: web/, cmd/desktop/, compose/web/, desktop CI
  workflow, ci.yml web job, Makefile ui/desktop/desktop-package/install
  targets, the compose web service, oikos-web from deploy.sh's fallback
  prune list; wails + go-keyring dropped from go.mod, vendor synced.
- README / CONTRIBUTING / AGENTS.md / .agents dev+operations docs now
  point at the new repo; mbse + mascot design docs carry a path note.

Risk: production SPA serving depends on the new pipeline now; rollback
is versioned-image re-up of the old web service from a pre-split
checkout (port 8091). Desktop builds installed before the split still
check dtoro/oikos releases — one manual reinstall, noted in the
oikos-web release notes.

Verification: go vet, make test (race), make generate-check, golangci
(no new findings; baseline down 400→365); post-cutover curls —
localhost:8091 200, /wails/runtime.js 404, outer Caddy 302 Authentik.

web/node_modules/postcss-selector-parser/dist/processor.js

@@ -0,0 +1,178 @@
+"use strict";
+
+exports.__esModule = true;
+exports["default"] = void 0;
+var _parser = _interopRequireDefault(require("./parser"));
+function _interopRequireDefault(e) { return e && e.__esModule ? e : { "default": e }; }
+var Processor = exports["default"] = /*#__PURE__*/function () {
+  function Processor(func, options) {
+    this.func = func || function noop() {};
+    this.funcRes = null;
+    this.options = options;
+  }
+  var _proto = Processor.prototype;
+  _proto._shouldUpdateSelector = function _shouldUpdateSelector(rule, options) {
+    if (options === void 0) {
+      options = {};
+    }
+    var merged = Object.assign({}, this.options, options);
+    if (merged.updateSelector === false) {
+      return false;
+    } else {
+      return typeof rule !== "string";
+    }
+  };
+  _proto._isLossy = function _isLossy(options) {
+    if (options === void 0) {
+      options = {};
+    }
+    var merged = Object.assign({}, this.options, options);
+    if (merged.lossless === false) {
+      return true;
+    } else {
+      return false;
+    }
+  };
+  _proto._root = function _root(rule, options) {
+    if (options === void 0) {
+      options = {};
+    }
+    var parser = new _parser["default"](rule, this._parseOptions(options));
+    return parser.root;
+  };
+  _proto._parseOptions = function _parseOptions(options) {
+    var merged = Object.assign({}, this.options, options);
+    return {
+      lossy: this._isLossy(merged),
+      maxNestingDepth: merged.maxNestingDepth
+    };
+  };
+  _proto._stringifyOptions = function _stringifyOptions(options) {
+    var merged = Object.assign({}, this.options, options);
+    return {
+      maxNestingDepth: merged.maxNestingDepth
+    };
+  };
+  _proto._run = function _run(rule, options) {
+    var _this = this;
+    if (options === void 0) {
+      options = {};
+    }
+    return new Promise(function (resolve, reject) {
+      try {
+        var root = _this._root(rule, options);
+        Promise.resolve(_this.func(root)).then(function (transform) {
+          var string = undefined;
+          if (_this._shouldUpdateSelector(rule, options)) {
+            string = root.toString(_this._stringifyOptions(options));
+            rule.selector = string;
+          }
+          return {
+            transform: transform,
+            root: root,
+            string: string
+          };
+        }).then(resolve, reject);
+      } catch (e) {
+        reject(e);
+        return;
+      }
+    });
+  };
+  _proto._runSync = function _runSync(rule, options) {
+    if (options === void 0) {
+      options = {};
+    }
+    var root = this._root(rule, options);
+    var transform = this.func(root);
+    if (transform && typeof transform.then === "function") {
+      throw new Error("Selector processor returned a promise to a synchronous call.");
+    }
+    var string = undefined;
+    if (options.updateSelector && typeof rule !== "string") {
+      string = root.toString(this._stringifyOptions(options));
+      rule.selector = string;
+    }
+    return {
+      transform: transform,
+      root: root,
+      string: string
+    };
+  }
+
+  /**
+   * Process rule into a selector AST.
+   *
+   * @param rule {postcss.Rule | string} The css selector to be processed
+   * @param options The options for processing
+   * @returns {Promise<parser.Root>} The AST of the selector after processing it.
+   */;
+  _proto.ast = function ast(rule, options) {
+    return this._run(rule, options).then(function (result) {
+      return result.root;
+    });
+  }
+
+  /**
+   * Process rule into a selector AST synchronously.
+   *
+   * @param rule {postcss.Rule | string} The css selector to be processed
+   * @param options The options for processing
+   * @returns {parser.Root} The AST of the selector after processing it.
+   */;
+  _proto.astSync = function astSync(rule, options) {
+    return this._runSync(rule, options).root;
+  }
+
+  /**
+   * Process a selector into a transformed value asynchronously
+   *
+   * @param rule {postcss.Rule | string} The css selector to be processed
+   * @param options The options for processing
+   * @returns {Promise<any>} The value returned by the processor.
+   */;
+  _proto.transform = function transform(rule, options) {
+    return this._run(rule, options).then(function (result) {
+      return result.transform;
+    });
+  }
+
+  /**
+   * Process a selector into a transformed value synchronously.
+   *
+   * @param rule {postcss.Rule | string} The css selector to be processed
+   * @param options The options for processing
+   * @returns {any} The value returned by the processor.
+   */;
+  _proto.transformSync = function transformSync(rule, options) {
+    return this._runSync(rule, options).transform;
+  }
+
+  /**
+   * Process a selector into a new selector string asynchronously.
+   *
+   * @param rule {postcss.Rule | string} The css selector to be processed
+   * @param options The options for processing
+   * @returns {string} the selector after processing.
+   */;
+  _proto.process = function process(rule, options) {
+    var _this2 = this;
+    return this._run(rule, options).then(function (result) {
+      return result.string || result.root.toString(_this2._stringifyOptions(options));
+    });
+  }
+
+  /**
+   * Process a selector into a new selector string synchronously.
+   *
+   * @param rule {postcss.Rule | string} The css selector to be processed
+   * @param options The options for processing
+   * @returns {string} the selector after processing.
+   */;
+  _proto.processSync = function processSync(rule, options) {
+    var result = this._runSync(rule, options);
+    return result.string || result.root.toString(this._stringifyOptions(options));
+  };
+  return Processor;
+}();
+module.exports = exports.default;