feat: Phase 1 — extract the client (web SPA + desktop) to dtoro/oikos-web

Problem: the hexagonal refactor churns the backend tree for nine more
phases; the UI delivery stack (web/ SPA, cmd/desktop Wails wrapper,
compose/web image) must move to its own repo first so doc/layout
rewrites land once on a backend-only tree.

Change:
- New repo git.hubris.network/dtoro/oikos-web (v0.33.0): web/, desktop/
  (updateURL repointed to oikos-web releases), compose/, own CI (web +
  desktop jobs), own deploy script (CI-green gate, TOCTOU guard,
  version-tagged images, prune-to-3), own webhook receiver on :9798 +
  launchd unit, own compose project publishing the same 8091:80.
- Cutover executed on mac-mini in order: oikos stack's web service
  stopped+removed, oikos-web project brought up on 8091; outer Caddy
  untouched (targets the published port) — serving + Authentik flow +
  /wails 404 quirk verified post-cutover.
- Stripped from oikos: web/, cmd/desktop/, compose/web/, desktop CI
  workflow, ci.yml web job, Makefile ui/desktop/desktop-package/install
  targets, the compose web service, oikos-web from deploy.sh's fallback
  prune list; wails + go-keyring dropped from go.mod, vendor synced.
- README / CONTRIBUTING / AGENTS.md / .agents dev+operations docs now
  point at the new repo; mbse + mascot design docs carry a path note.

Risk: production SPA serving depends on the new pipeline now; rollback
is versioned-image re-up of the old web service from a pre-split
checkout (port 8091). Desktop builds installed before the split still
check dtoro/oikos releases — one manual reinstall, noted in the
oikos-web release notes.

Verification: go vet, make test (race), make generate-check, golangci
(no new findings; baseline down 400→365); post-cutover curls —
localhost:8091 200, /wails/runtime.js 404, outer Caddy 302 Authentik.

web/node_modules/runed/dist/internal/utils/array.d.ts

@@ -0,0 +1,5 @@
+/**
+ * Get nth item of Array. Negative for backward
+ */
+export declare function at<T>(array: readonly T[], index: number): T | undefined;
+export declare function last<T>(array: readonly T[]): T | undefined;

web/node_modules/runed/dist/internal/utils/array.js

@@ -0,0 +1,14 @@
+/**
+ * Get nth item of Array. Negative for backward
+ */
+export function at(array, index) {
+    const len = array.length;
+    if (!len)
+        return undefined;
+    if (index < 0)
+        index += len;
+    return array[index];
+}
+export function last(array) {
+    return array[array.length - 1];
+}

web/node_modules/runed/dist/internal/utils/browser.d.ts

@@ -0,0 +1 @@
+export { BROWSER as browser } from "esm-env";

web/node_modules/runed/dist/internal/utils/browser.js

@@ -0,0 +1 @@
+export { BROWSER as browser } from "esm-env";

web/node_modules/runed/dist/internal/utils/dom.d.ts

@@ -0,0 +1,25 @@
+/**
+ * Handles getting the active element in a document or shadow root.
+ * If the active element is within a shadow root, it will traverse the shadow root
+ * to find the active element.
+ * If not, it will return the active element in the document.
+ *
+ * @param document A document or shadow root to get the active element from.
+ * @returns The active element in the document or shadow root.
+ */
+export declare function getActiveElement(document: DocumentOrShadowRoot): Element | null;
+/**
+ * Returns the owner document of a given element.
+ *
+ * @param node The element to get the owner document from.
+ * @returns
+ */
+export declare function getOwnerDocument(node: Element | null | undefined, fallback?: Document | undefined): Document | undefined;
+/**
+ * Checks if an element is or is contained by another element.
+ *
+ * @param node The element to check if it or its descendants contain the target element.
+ * @param target The element to check if it is contained by the node.
+ * @returns
+ */
+export declare function isOrContainsTarget(node: Element, target: Element): boolean;

web/node_modules/runed/dist/internal/utils/dom.js

@@ -0,0 +1,40 @@
+import { defaultDocument } from "../configurable-globals.js";
+/**
+ * Handles getting the active element in a document or shadow root.
+ * If the active element is within a shadow root, it will traverse the shadow root
+ * to find the active element.
+ * If not, it will return the active element in the document.
+ *
+ * @param document A document or shadow root to get the active element from.
+ * @returns The active element in the document or shadow root.
+ */
+export function getActiveElement(document) {
+    let activeElement = document.activeElement;
+    while (activeElement?.shadowRoot) {
+        const node = activeElement.shadowRoot.activeElement;
+        if (node === activeElement)
+            break;
+        else
+            activeElement = node;
+    }
+    return activeElement;
+}
+/**
+ * Returns the owner document of a given element.
+ *
+ * @param node The element to get the owner document from.
+ * @returns
+ */
+export function getOwnerDocument(node, fallback = defaultDocument) {
+    return node?.ownerDocument ?? fallback;
+}
+/**
+ * Checks if an element is or is contained by another element.
+ *
+ * @param node The element to check if it or its descendants contain the target element.
+ * @param target The element to check if it is contained by the node.
+ * @returns
+ */
+export function isOrContainsTarget(node, target) {
+    return node === target || node.contains(target);
+}

web/node_modules/runed/dist/internal/utils/function.d.ts

@@ -0,0 +1 @@
+export declare function noop(): void;

web/node_modules/runed/dist/internal/utils/function.js

@@ -0,0 +1 @@
+export function noop() { }

web/node_modules/runed/dist/internal/utils/get.d.ts

@@ -0,0 +1,2 @@
+import type { MaybeGetter } from "../types.js";
+export declare function get<T>(value: MaybeGetter<T>): T;

web/node_modules/runed/dist/internal/utils/get.js

@@ -0,0 +1,7 @@
+import { isFunction } from "./is.js";
+export function get(value) {
+    if (isFunction(value)) {
+        return value();
+    }
+    return value;
+}

web/node_modules/runed/dist/internal/utils/is.d.ts

@@ -0,0 +1,3 @@
+export declare function isFunction(value: unknown): value is (...args: unknown[]) => unknown;
+export declare function isObject(value: unknown): value is Record<PropertyKey, unknown>;
+export declare function isElement(value: unknown): value is Element;

web/node_modules/runed/dist/internal/utils/is.js

@@ -0,0 +1,9 @@
+export function isFunction(value) {
+    return typeof value === "function";
+}
+export function isObject(value) {
+    return value !== null && typeof value === "object";
+}
+export function isElement(value) {
+    return value instanceof Element;
+}

web/node_modules/runed/dist/internal/utils/sleep.d.ts

@@ -0,0 +1 @@
+export declare function sleep(ms?: number): Promise<void>;

web/node_modules/runed/dist/internal/utils/sleep.js

@@ -0,0 +1,3 @@
+export async function sleep(ms = 0) {
+    return new Promise((resolve) => setTimeout(resolve, ms));
+}