feat: Phase 1 — extract the client (web SPA + desktop) to dtoro/oikos-web

Problem: the hexagonal refactor churns the backend tree for nine more
phases; the UI delivery stack (web/ SPA, cmd/desktop Wails wrapper,
compose/web image) must move to its own repo first so doc/layout
rewrites land once on a backend-only tree.

Change:
- New repo git.hubris.network/dtoro/oikos-web (v0.33.0): web/, desktop/
  (updateURL repointed to oikos-web releases), compose/, own CI (web +
  desktop jobs), own deploy script (CI-green gate, TOCTOU guard,
  version-tagged images, prune-to-3), own webhook receiver on :9798 +
  launchd unit, own compose project publishing the same 8091:80.
- Cutover executed on mac-mini in order: oikos stack's web service
  stopped+removed, oikos-web project brought up on 8091; outer Caddy
  untouched (targets the published port) — serving + Authentik flow +
  /wails 404 quirk verified post-cutover.
- Stripped from oikos: web/, cmd/desktop/, compose/web/, desktop CI
  workflow, ci.yml web job, Makefile ui/desktop/desktop-package/install
  targets, the compose web service, oikos-web from deploy.sh's fallback
  prune list; wails + go-keyring dropped from go.mod, vendor synced.
- README / CONTRIBUTING / AGENTS.md / .agents dev+operations docs now
  point at the new repo; mbse + mascot design docs carry a path note.

Risk: production SPA serving depends on the new pipeline now; rollback
is versioned-image re-up of the old web service from a pre-split
checkout (port 8091). Desktop builds installed before the split still
check dtoro/oikos releases — one manual reinstall, noted in the
oikos-web release notes.

Verification: go vet, make test (race), make generate-check, golangci
(no new findings; baseline down 400→365); post-cutover curls —
localhost:8091 200, /wails/runtime.js 404, outer Caddy 302 Authentik.

web/node_modules/rollup/dist/es/getLogFilter.js

@@ -0,0 +1,65 @@
+/*
+  @license
+	Rollup.js v4.62.4
+	Sat, 01 Aug 2026 05:20:25 GMT - commit ddc4ffab628944e45dbb8d66d58aae818015440f
+
+	https://github.com/rollup/rollup
+
+	Released under the MIT License.
+*/
+const getLogFilter = filters => {
+    if (filters.length === 0)
+        return () => true;
+    const normalizedFilters = filters.map(filter => filter.split('&').map(subFilter => {
+        const inverted = subFilter[0] === '!';
+        if (inverted)
+            subFilter = subFilter.slice(1);
+        const [key, ...value] = subFilter.split(':');
+        return { inverted, key: key.split('.'), parts: value.join(':').split('*') };
+    }));
+    return (log) => {
+        nextIntersectedFilter: for (const intersectedFilters of normalizedFilters) {
+            for (const { inverted, key, parts } of intersectedFilters) {
+                const isFilterSatisfied = testFilter(log, key, parts);
+                if (inverted ? isFilterSatisfied : !isFilterSatisfied) {
+                    continue nextIntersectedFilter;
+                }
+            }
+            return true;
+        }
+        return false;
+    };
+};
+const testFilter = (log, key, parts) => {
+    let rawValue = log;
+    for (let index = 0; index < key.length; index++) {
+        if (!rawValue) {
+            return false;
+        }
+        const part = key[index];
+        if (!(part in rawValue)) {
+            return false;
+        }
+        rawValue = rawValue[part];
+    }
+    let value = typeof rawValue === 'object' ? JSON.stringify(rawValue) : String(rawValue);
+    if (parts.length === 1) {
+        return value === parts[0];
+    }
+    if (!value.startsWith(parts[0])) {
+        return false;
+    }
+    value = value.slice(parts[0].length);
+    const lastPartIndex = parts.length - 1;
+    for (let index = 1; index < lastPartIndex; index++) {
+        const part = parts[index];
+        const position = value.indexOf(part);
+        if (position === -1) {
+            return false;
+        }
+        value = value.slice(position + part.length);
+    }
+    return value.endsWith(parts[lastPartIndex]);
+};
+
+export { getLogFilter };

web/node_modules/rollup/dist/es/package.json

@@ -0,0 +1 @@
+{"type":"module"}

web/node_modules/rollup/dist/es/parseAst.js

@@ -0,0 +1,12 @@
+/*
+  @license
+	Rollup.js v4.62.4
+	Sat, 01 Aug 2026 05:20:25 GMT - commit ddc4ffab628944e45dbb8d66d58aae818015440f
+
+	https://github.com/rollup/rollup
+
+	Released under the MIT License.
+*/
+import '../native.js';
+export { parseAst, parseAstAsync } from './shared/parseAst.js';
+import 'node:path';

web/node_modules/rollup/dist/es/rollup.js

@@ -0,0 +1,17 @@
+/*
+  @license
+	Rollup.js v4.62.4
+	Sat, 01 Aug 2026 05:20:25 GMT - commit ddc4ffab628944e45dbb8d66d58aae818015440f
+
+	https://github.com/rollup/rollup
+
+	Released under the MIT License.
+*/
+export { VERSION, defineConfig, rollup, watch } from './shared/node-entry.js';
+import './shared/parseAst.js';
+import '../native.js';
+import 'node:path';
+import 'path';
+import 'node:process';
+import 'node:perf_hooks';
+import 'node:fs/promises';