feat: Phase 1 — extract the client (web SPA + desktop) to dtoro/oikos-web

Problem: the hexagonal refactor churns the backend tree for nine more
phases; the UI delivery stack (web/ SPA, cmd/desktop Wails wrapper,
compose/web image) must move to its own repo first so doc/layout
rewrites land once on a backend-only tree.

Change:
- New repo git.hubris.network/dtoro/oikos-web (v0.33.0): web/, desktop/
  (updateURL repointed to oikos-web releases), compose/, own CI (web +
  desktop jobs), own deploy script (CI-green gate, TOCTOU guard,
  version-tagged images, prune-to-3), own webhook receiver on :9798 +
  launchd unit, own compose project publishing the same 8091:80.
- Cutover executed on mac-mini in order: oikos stack's web service
  stopped+removed, oikos-web project brought up on 8091; outer Caddy
  untouched (targets the published port) — serving + Authentik flow +
  /wails 404 quirk verified post-cutover.
- Stripped from oikos: web/, cmd/desktop/, compose/web/, desktop CI
  workflow, ci.yml web job, Makefile ui/desktop/desktop-package/install
  targets, the compose web service, oikos-web from deploy.sh's fallback
  prune list; wails + go-keyring dropped from go.mod, vendor synced.
- README / CONTRIBUTING / AGENTS.md / .agents dev+operations docs now
  point at the new repo; mbse + mascot design docs carry a path note.

Risk: production SPA serving depends on the new pipeline now; rollback
is versioned-image re-up of the old web service from a pre-split
checkout (port 8091). Desktop builds installed before the split still
check dtoro/oikos releases — one manual reinstall, noted in the
oikos-web release notes.

Verification: go vet, make test (race), make generate-check, golangci
(no new findings; baseline down 400→365); post-cutover curls —
localhost:8091 200, /wails/runtime.js 404, outer Caddy 302 Authentik.

web/node_modules/runed/dist/utilities/finite-state-machine/finite-state-machine.svelte.js

@@ -0,0 +1,78 @@
+export function isLifecycleFnMeta(meta) {
+    return (!!meta &&
+        typeof meta === "object" &&
+        "to" in meta &&
+        "from" in meta &&
+        "event" in meta &&
+        "args" in meta);
+}
+/**
+ * Defines a strongly-typed finite state machine.
+ *
+ * @see {@link https://runed.dev/docs/utilities/finite-state-machine}
+ */
+export class FiniteStateMachine {
+    #current = $state();
+    states;
+    #timeout = {};
+    constructor(initial, states) {
+        this.#current = initial;
+        this.states = states;
+        this.send = this.send.bind(this);
+        this.debounce = this.debounce.bind(this);
+        // synthetically trigger _enter for the initial state.
+        this.#dispatch("_enter", { from: null, to: initial, event: null, args: [] });
+    }
+    #transition(newState, event, args) {
+        const metadata = { from: this.#current, to: newState, event, args };
+        this.#dispatch("_exit", metadata);
+        this.#current = newState;
+        this.#dispatch("_enter", metadata);
+    }
+    #dispatch(event, ...args) {
+        const action = this.states[this.#current]?.[event] ?? this.states["*"]?.[event];
+        if (action instanceof Function) {
+            if (event === "_enter" || event === "_exit") {
+                if (isLifecycleFnMeta(args[0])) {
+                    action(args[0]);
+                }
+                else {
+                    console.warn("Invalid metadata passed to lifecycle function of the FSM.");
+                }
+            }
+            else {
+                return action(...args);
+            }
+        }
+        else if (typeof action === "string") {
+            return action;
+        }
+        else if (event !== "_enter" && event !== "_exit") {
+            console.warn("No action defined for event", event, "in state", this.#current);
+        }
+    }
+    /** Triggers a new event and returns the new state. */
+    send(event, ...args) {
+        const newState = this.#dispatch(event, ...args);
+        if (newState && newState !== this.#current) {
+            this.#transition(newState, event, args);
+        }
+        return this.#current;
+    }
+    /** Debounces the triggering of an event. */
+    async debounce(wait = 500, event, ...args) {
+        if (this.#timeout[event]) {
+            clearTimeout(this.#timeout[event]);
+        }
+        return new Promise((resolve) => {
+            this.#timeout[event] = setTimeout(() => {
+                delete this.#timeout[event];
+                resolve(this.send(event, ...args));
+            }, wait);
+        });
+    }
+    /** The current state. */
+    get current() {
+        return this.#current;
+    }
+}