feat: Phase 1 — extract the client (web SPA + desktop) to dtoro/oikos-web

Problem: the hexagonal refactor churns the backend tree for nine more
phases; the UI delivery stack (web/ SPA, cmd/desktop Wails wrapper,
compose/web image) must move to its own repo first so doc/layout
rewrites land once on a backend-only tree.

Change:
- New repo git.hubris.network/dtoro/oikos-web (v0.33.0): web/, desktop/
  (updateURL repointed to oikos-web releases), compose/, own CI (web +
  desktop jobs), own deploy script (CI-green gate, TOCTOU guard,
  version-tagged images, prune-to-3), own webhook receiver on :9798 +
  launchd unit, own compose project publishing the same 8091:80.
- Cutover executed on mac-mini in order: oikos stack's web service
  stopped+removed, oikos-web project brought up on 8091; outer Caddy
  untouched (targets the published port) — serving + Authentik flow +
  /wails 404 quirk verified post-cutover.
- Stripped from oikos: web/, cmd/desktop/, compose/web/, desktop CI
  workflow, ci.yml web job, Makefile ui/desktop/desktop-package/install
  targets, the compose web service, oikos-web from deploy.sh's fallback
  prune list; wails + go-keyring dropped from go.mod, vendor synced.
- README / CONTRIBUTING / AGENTS.md / .agents dev+operations docs now
  point at the new repo; mbse + mascot design docs carry a path note.

Risk: production SPA serving depends on the new pipeline now; rollback
is versioned-image re-up of the old web service from a pre-split
checkout (port 8091). Desktop builds installed before the split still
check dtoro/oikos releases — one manual reinstall, noted in the
oikos-web release notes.

Verification: go vet, make test (race), make generate-check, golangci
(no new findings; baseline down 400→365); post-cutover curls —
localhost:8091 200, /wails/runtime.js 404, outer Caddy 302 Authentik.

web/node_modules/readdirp/esm/index.d.ts

@@ -0,0 +1,108 @@
+/**
+ * Recursive version of readdir. Exposes a streaming API and promise API.
+ * Streaming API allows to use a small amount of RAM.
+ *
+ * @module
+ * @example
+```js
+import readdirp from 'readdirp';
+for await (const entry of readdirp('.')) {
+  const {path} = entry;
+  console.log(`${JSON.stringify({path})}`);
+}
+```
+ */
+/*! readdirp - MIT License (c) 2012-2019 Thorsten Lorenz, Paul Miller (https://paulmillr.com) */
+import type { Stats, Dirent } from 'node:fs';
+import { Readable } from 'node:stream';
+/** Path in file system. */
+export type Path = string;
+/** Emitted entry. Contains relative & absolute path, basename, and either stats or dirent. */
+export interface EntryInfo {
+    path: string;
+    fullPath: string;
+    stats?: Stats;
+    dirent?: Dirent;
+    basename: string;
+}
+/** Path or dir entries (files) */
+export type PathOrDirent = Dirent | Path;
+/** Filterer for files */
+export type Tester = (entryInfo: EntryInfo) => boolean;
+export type Predicate = string[] | string | Tester;
+export declare const EntryTypes: {
+    readonly FILE_TYPE: "files";
+    readonly DIR_TYPE: "directories";
+    readonly FILE_DIR_TYPE: "files_directories";
+    readonly EVERYTHING_TYPE: "all";
+};
+export type EntryType = (typeof EntryTypes)[keyof typeof EntryTypes];
+/**
+ * Options for readdirp.
+ * * type: files, directories, or both
+ * * lstat: whether to use symlink-friendly stat
+ * * depth: max depth
+ * * alwaysStat: whether to use stat (more resources) or dirent
+ * * highWaterMark: streaming param, specifies max amount of resources per entry
+ */
+export type ReaddirpOptions = {
+    root: string;
+    fileFilter?: Predicate;
+    directoryFilter?: Predicate;
+    type?: EntryType;
+    lstat?: boolean;
+    depth?: number;
+    alwaysStat?: boolean;
+    highWaterMark?: number;
+};
+/** Directory entry. Contains path, depth count, and files. */
+export interface DirEntry {
+    files: PathOrDirent[];
+    depth: number;
+    path: Path;
+}
+/** Readable readdir stream, emitting new files as they're being listed. */
+export declare class ReaddirpStream extends Readable {
+    parents: any[];
+    reading: boolean;
+    parent?: DirEntry;
+    _stat: Function;
+    _maxDepth: number;
+    _wantsDir: boolean;
+    _wantsFile: boolean;
+    _wantsEverything: boolean;
+    _root: Path;
+    _isDirent: boolean;
+    _statsProp: 'dirent' | 'stats';
+    _rdOptions: {
+        encoding: 'utf8';
+        withFileTypes: boolean;
+    };
+    _fileFilter: Tester;
+    _directoryFilter: Tester;
+    constructor(options?: Partial<ReaddirpOptions>);
+    _read(batch: number): Promise<void>;
+    _exploreDir(path: Path, depth: number): Promise<{
+        files: string[] | undefined;
+        depth: number;
+        path: string;
+    }>;
+    _formatEntry(dirent: PathOrDirent, path: Path): Promise<EntryInfo | undefined>;
+    _onError(err: Error): void;
+    _getEntryType(entry: EntryInfo): Promise<void | '' | 'file' | 'directory'>;
+    _includeAsFile(entry: EntryInfo): boolean | undefined;
+}
+/**
+ * Streaming version: Reads all files and directories in given root recursively.
+ * Consumes ~constant small amount of RAM.
+ * @param root Root directory
+ * @param options Options to specify root (start directory), filters and recursion depth
+ */
+export declare function readdirp(root: Path, options?: Partial<ReaddirpOptions>): ReaddirpStream;
+/**
+ * Promise version: Reads all files and directories in given root recursively.
+ * Compared to streaming version, will consume a lot of RAM e.g. when 1 million files are listed.
+ * @returns array of paths and their entry infos
+ */
+export declare function readdirpPromise(root: Path, options?: Partial<ReaddirpOptions>): Promise<EntryInfo[]>;
+export default readdirp;