feat: Phase 1 — extract the client (web SPA + desktop) to dtoro/oikos-web

Problem: the hexagonal refactor churns the backend tree for nine more
phases; the UI delivery stack (web/ SPA, cmd/desktop Wails wrapper,
compose/web image) must move to its own repo first so doc/layout
rewrites land once on a backend-only tree.

Change:
- New repo git.hubris.network/dtoro/oikos-web (v0.33.0): web/, desktop/
  (updateURL repointed to oikos-web releases), compose/, own CI (web +
  desktop jobs), own deploy script (CI-green gate, TOCTOU guard,
  version-tagged images, prune-to-3), own webhook receiver on :9798 +
  launchd unit, own compose project publishing the same 8091:80.
- Cutover executed on mac-mini in order: oikos stack's web service
  stopped+removed, oikos-web project brought up on 8091; outer Caddy
  untouched (targets the published port) — serving + Authentik flow +
  /wails 404 quirk verified post-cutover.
- Stripped from oikos: web/, cmd/desktop/, compose/web/, desktop CI
  workflow, ci.yml web job, Makefile ui/desktop/desktop-package/install
  targets, the compose web service, oikos-web from deploy.sh's fallback
  prune list; wails + go-keyring dropped from go.mod, vendor synced.
- README / CONTRIBUTING / AGENTS.md / .agents dev+operations docs now
  point at the new repo; mbse + mascot design docs carry a path note.

Risk: production SPA serving depends on the new pipeline now; rollback
is versioned-image re-up of the old web service from a pre-split
checkout (port 8091). Desktop builds installed before the split still
check dtoro/oikos releases — one manual reinstall, noted in the
oikos-web release notes.

Verification: go vet, make test (race), make generate-check, golangci
(no new findings; baseline down 400→365); post-cutover curls —
localhost:8091 200, /wails/runtime.js 404, outer Caddy 302 Authentik.

web/node_modules/siginfo/.travis.yml

@@ -0,0 +1,13 @@
+notifications:
+  email: false
+language: node_js
+node_js:
+- node
+deploy:
+  provider: npm
+  email:
+    secure: Y10Dvn9UbfpZPbulnl/e7dsiN/1xr06h7k6nJZyxRzr9Hh0UUFPism6k5CFaSegyPIF7sODNBQz4lvXIi2NwcvTLQruw5ehXW0NJ/G7x1TU94pzzhVJ31KBlRWzjKdvVTDsDzFxe5wKWxagPUTkieiIN9CWTQjafByNs3zbK8HL7cmu4Nc42JquVGbtpGgLs7Js+tY+WVB1dMQ4SfqpFgWjm2h05uyXCWHLK5amEAZJLP755lOVgMzw/jQGRg7J4vX4+eRE0r/g0v09x9FUU3ROEmJvqYa14CmGESRhSUyRlv4pnMIs/aK8ZDD8ia3eoTSvMJv8mzdvpkvKzWV1HSZFUX3QZVgWJEmeoF6XP+mdkWu5gnZVlOIBc8NANcS60Dr8QwF470xpPxsyAyf2o9UzX8Xy2qO8XNY/TykGO4soCfOEuVNdw5F9hHEldMHY8p9Z8EJSCn/xfM//LEvxRKREYsMqFtsnwUsv+qiAkHPSHXWQo6HYp+/xDchv63NxtjGHdPs9VpUFr1F8CxZjdis2HZfOnx51W0JIwNYlXNxeqC3WjRUqvRp2NknS982lRHCkHtZfHijGvMm7kj3QL+Ufc7pIfEGnMAKKiNv9kOryjQc29046pRZww9lWjrhoCeEPRhFbkgFV7Mo3bvOExstsSdRnOTlogCe4NviKOwfE=
+  api_key:
+    secure: cAmf8extX/sPl+sxC/6sWTmaiSGrXQY9C/lLg9c76Qn12MLysxDYgCRXfl8Az3RIbRuajq0SbyWXeDa/4wZc1PazuUGjZG82na+kuEDg8m5z0gLiJlhp60C0nj3WMJaRBRsOha1Jbs59eU3XNy+H0U5VczHrdw6v2yCHTlauhT/NYiPXMyKmTIJPB/X7gryFuXVhCPNdRBp3rPicbt0d68J+vWv9KNpjA1WB0WDUSl5rMUQbjjsRF2/DKj9WxXjmci+ac+/pCN3rQxgYZ0Ot5o5/RcWucc21ZdFgsLo8dq5YZDl/EQf/pPmkhquiiLRhiTyCBbEw1sDzYHTbTJThrukrZALg0on7XvxbXSQrxgc/IMJ/RT0PoGLEqyAZUSzGa6HPVlHUBt4LB3zgrswGmGUVkZmbiag0foIFeCKlydwEyBYfnFdRddxF6n3irft1l1NJ1HKNxKLnKvyt8iaOlGteXOOfLXzU17DgMgwTsZsvFmtFQcs6yolLHW9RnRTLf56+x/kJZ4kVJjHuyb/98pS4F7etJ2SpZqt1cVUFd/AYtnxL3jKiUhJLNL8hNUIH3eSpMfZUOUxGv1OWuwgyEhSONkITF2VPn4yuyxS23Ewq4LLj/u/9sPlLaGSN4Avaw21gi6L+M9x620sTZHYtNLniVMTAu6aPiM32zPreK2I=
+  on:
+    tags: true