feat: Phase 1 — extract the client (web SPA + desktop) to dtoro/oikos-web

Problem: the hexagonal refactor churns the backend tree for nine more
phases; the UI delivery stack (web/ SPA, cmd/desktop Wails wrapper,
compose/web image) must move to its own repo first so doc/layout
rewrites land once on a backend-only tree.

Change:
- New repo git.hubris.network/dtoro/oikos-web (v0.33.0): web/, desktop/
  (updateURL repointed to oikos-web releases), compose/, own CI (web +
  desktop jobs), own deploy script (CI-green gate, TOCTOU guard,
  version-tagged images, prune-to-3), own webhook receiver on :9798 +
  launchd unit, own compose project publishing the same 8091:80.
- Cutover executed on mac-mini in order: oikos stack's web service
  stopped+removed, oikos-web project brought up on 8091; outer Caddy
  untouched (targets the published port) — serving + Authentik flow +
  /wails 404 quirk verified post-cutover.
- Stripped from oikos: web/, cmd/desktop/, compose/web/, desktop CI
  workflow, ci.yml web job, Makefile ui/desktop/desktop-package/install
  targets, the compose web service, oikos-web from deploy.sh's fallback
  prune list; wails + go-keyring dropped from go.mod, vendor synced.
- README / CONTRIBUTING / AGENTS.md / .agents dev+operations docs now
  point at the new repo; mbse + mascot design docs carry a path note.

Risk: production SPA serving depends on the new pipeline now; rollback
is versioned-image re-up of the old web service from a pre-split
checkout (port 8091). Desktop builds installed before the split still
check dtoro/oikos releases — one manual reinstall, noted in the
oikos-web release notes.

Verification: go vet, make test (race), make generate-check, golangci
(no new findings; baseline down 400→365); post-cutover curls —
localhost:8091 200, /wails/runtime.js 404, outer Caddy 302 Authentik.

web/node_modules/runed/dist/utilities/persisted-state/persisted-state.svelte.js

@@ -0,0 +1,117 @@
+import { defaultWindow } from "../../internal/configurable-globals.js";
+import { on } from "svelte/events";
+import { createSubscriber } from "svelte/reactivity";
+function getStorage(storageType, window) {
+    switch (storageType) {
+        case "local":
+            return window.localStorage;
+        case "session":
+            return window.sessionStorage;
+    }
+}
+function proxy(value, root, proxies, subscribe, update, serialize) {
+    if (value === null || typeof value !== "object") {
+        return value;
+    }
+    const proto = Object.getPrototypeOf(value);
+    if (proto !== null && proto !== Object.prototype && !Array.isArray(value)) {
+        return value;
+    }
+    let p = proxies.get(value);
+    if (!p) {
+        p = new Proxy(value, {
+            get: (target, property) => {
+                subscribe?.();
+                return proxy(Reflect.get(target, property), root, proxies, subscribe, update, serialize);
+            },
+            set: (target, property, value) => {
+                update?.();
+                Reflect.set(target, property, value);
+                serialize(root);
+                return true;
+            },
+        });
+        proxies.set(value, p);
+    }
+    return p;
+}
+/**
+ * Creates reactive state that is persisted and synchronized across browser sessions and tabs using Web Storage.
+ * @param key The unique key used to store the state in the storage.
+ * @param initialValue The initial value of the state if not already present in the storage.
+ * @param options Configuration options including storage type, serializer for complex data types, and whether to sync state changes across tabs.
+ *
+ * @see {@link https://runed.dev/docs/utilities/persisted-state}
+ */
+export class PersistedState {
+    #current;
+    #key;
+    #serializer;
+    #storage;
+    #subscribe;
+    #update;
+    #proxies = new WeakMap();
+    constructor(key, initialValue, options = {}) {
+        const { storage: storageType = "local", serializer = { serialize: JSON.stringify, deserialize: JSON.parse }, syncTabs = true, } = options;
+        const window = "window" in options ? options.window : defaultWindow; // window is not mockable to be undefined without this, because JavaScript will fill undefined with `= default`
+        this.#current = initialValue;
+        this.#key = key;
+        this.#serializer = serializer;
+        if (window === undefined)
+            return;
+        const storage = getStorage(storageType, window);
+        this.#storage = storage;
+        const existingValue = storage.getItem(key);
+        if (existingValue !== null) {
+            this.#current = this.#deserialize(existingValue);
+        }
+        else {
+            this.#serialize(initialValue);
+        }
+        this.#subscribe = createSubscriber((update) => {
+            this.#update = update;
+            const cleanup = syncTabs && storageType === "local"
+                ? on(window, "storage", this.#handleStorageEvent)
+                : null;
+            return () => {
+                cleanup?.();
+                this.#update = undefined;
+            };
+        });
+    }
+    get current() {
+        this.#subscribe?.();
+        const storageItem = this.#storage?.getItem(this.#key);
+        const root = storageItem ? this.#deserialize(storageItem) : this.#current;
+        return proxy(root, root, this.#proxies, this.#subscribe?.bind(this), this.#update?.bind(this), this.#serialize.bind(this));
+    }
+    set current(newValue) {
+        this.#serialize(newValue);
+        this.#update?.();
+    }
+    #handleStorageEvent = (event) => {
+        if (event.key !== this.#key || event.newValue === null)
+            return;
+        this.#current = this.#deserialize(event.newValue);
+        this.#update?.();
+    };
+    #deserialize(value) {
+        try {
+            return this.#serializer.deserialize(value);
+        }
+        catch (error) {
+            console.error(`Error when parsing "${value}" from persisted store "${this.#key}"`, error);
+            return;
+        }
+    }
+    #serialize(value) {
+        try {
+            if (value != undefined) {
+                this.#storage?.setItem(this.#key, this.#serializer.serialize(value));
+            }
+        }
+        catch (error) {
+            console.error(`Error when writing value from persisted store "${this.#key}" to ${this.#storage}`, error);
+        }
+    }
+}