feat: Phase 1 — extract the client (web SPA + desktop) to dtoro/oikos-web

Problem: the hexagonal refactor churns the backend tree for nine more
phases; the UI delivery stack (web/ SPA, cmd/desktop Wails wrapper,
compose/web image) must move to its own repo first so doc/layout
rewrites land once on a backend-only tree.

Change:
- New repo git.hubris.network/dtoro/oikos-web (v0.33.0): web/, desktop/
  (updateURL repointed to oikos-web releases), compose/, own CI (web +
  desktop jobs), own deploy script (CI-green gate, TOCTOU guard,
  version-tagged images, prune-to-3), own webhook receiver on :9798 +
  launchd unit, own compose project publishing the same 8091:80.
- Cutover executed on mac-mini in order: oikos stack's web service
  stopped+removed, oikos-web project brought up on 8091; outer Caddy
  untouched (targets the published port) — serving + Authentik flow +
  /wails 404 quirk verified post-cutover.
- Stripped from oikos: web/, cmd/desktop/, compose/web/, desktop CI
  workflow, ci.yml web job, Makefile ui/desktop/desktop-package/install
  targets, the compose web service, oikos-web from deploy.sh's fallback
  prune list; wails + go-keyring dropped from go.mod, vendor synced.
- README / CONTRIBUTING / AGENTS.md / .agents dev+operations docs now
  point at the new repo; mbse + mascot design docs carry a path note.

Risk: production SPA serving depends on the new pipeline now; rollback
is versioned-image re-up of the old web service from a pre-split
checkout (port 8091). Desktop builds installed before the split still
check dtoro/oikos releases — one manual reinstall, noted in the
oikos-web release notes.

Verification: go vet, make test (race), make generate-check, golangci
(no new findings; baseline down 400→365); post-cutover curls —
localhost:8091 200, /wails/runtime.js 404, outer Caddy 302 Authentik.

web/node_modules/sigma/settings/dist/sigma-settings.cjs.dev.js

@@ -0,0 +1,119 @@
+'use strict';
+
+Object.defineProperty(exports, '__esModule', { value: true });
+
+var index = require('../../dist/index-5d7c4e29.cjs.dev.js');
+var data = require('../../dist/data-24ae515b.cjs.dev.js');
+require('../../dist/inherits-04acba6b.cjs.dev.js');
+require('../../dist/colors-fe6de9d2.cjs.dev.js');
+
+/**
+ * Sigma.js Settings
+ * =================================
+ *
+ * The list of settings and some handy functions.
+ * @module
+ */
+
+/**
+ * Sigma.js settings
+ * =================================
+ */
+
+var DEFAULT_SETTINGS = {
+  // Performance
+  hideEdgesOnMove: false,
+  hideLabelsOnMove: false,
+  renderLabels: true,
+  renderEdgeLabels: false,
+  enableEdgeEvents: false,
+  // Component rendering
+  defaultNodeColor: "#999",
+  defaultNodeType: "circle",
+  defaultEdgeColor: "#ccc",
+  defaultEdgeType: "line",
+  labelFont: "Arial",
+  labelSize: 14,
+  labelWeight: "normal",
+  labelColor: {
+    color: "#000"
+  },
+  edgeLabelFont: "Arial",
+  edgeLabelSize: 14,
+  edgeLabelWeight: "normal",
+  edgeLabelColor: {
+    attribute: "color"
+  },
+  stagePadding: 30,
+  defaultDrawEdgeLabel: index.drawStraightEdgeLabel,
+  defaultDrawNodeLabel: index.drawDiscNodeLabel,
+  defaultDrawNodeHover: index.drawDiscNodeHover,
+  minEdgeThickness: 1.7,
+  antiAliasingFeather: 1,
+  // Mouse and touch settings
+  dragTimeout: 100,
+  draggedEventsTolerance: 3,
+  inertiaDuration: 200,
+  inertiaRatio: 3,
+  zoomDuration: 250,
+  zoomingRatio: 1.7,
+  doubleClickTimeout: 300,
+  doubleClickZoomingRatio: 2.2,
+  doubleClickZoomingDuration: 200,
+  tapMoveTolerance: 10,
+  // Size and scaling
+  zoomToSizeRatioFunction: Math.sqrt,
+  itemSizesReference: "screen",
+  autoRescale: true,
+  autoCenter: true,
+  // Labels
+  labelDensity: 1,
+  labelGridCellSize: 100,
+  labelRenderedSizeThreshold: 6,
+  // Reducers
+  nodeReducer: null,
+  edgeReducer: null,
+  // Features
+  zIndex: false,
+  minCameraRatio: null,
+  maxCameraRatio: null,
+  enableCameraZooming: true,
+  enableCameraPanning: true,
+  enableCameraRotation: true,
+  cameraPanBoundaries: null,
+  // Lifecycle
+  allowInvalidContainer: false,
+  // Program classes
+  nodeProgramClasses: {},
+  nodeHoverProgramClasses: {},
+  edgeProgramClasses: {}
+};
+var DEFAULT_NODE_PROGRAM_CLASSES = {
+  circle: index.NodeCircleProgram
+};
+var DEFAULT_EDGE_PROGRAM_CLASSES = {
+  arrow: index.EdgeArrowProgram,
+  line: index.EdgeRectangleProgram
+};
+function validateSettings(settings) {
+  if (typeof settings.labelDensity !== "number" || settings.labelDensity < 0) {
+    throw new Error("Settings: invalid `labelDensity`. Expecting a positive number.");
+  }
+  var minCameraRatio = settings.minCameraRatio,
+    maxCameraRatio = settings.maxCameraRatio;
+  if (typeof minCameraRatio === "number" && typeof maxCameraRatio === "number" && maxCameraRatio < minCameraRatio) {
+    throw new Error("Settings: invalid camera ratio boundaries. Expecting `maxCameraRatio` to be greater than `minCameraRatio`.");
+  }
+}
+function resolveSettings(settings) {
+  var resolvedSettings = data.assign({}, DEFAULT_SETTINGS, settings);
+  resolvedSettings.nodeProgramClasses = data.assign({}, DEFAULT_NODE_PROGRAM_CLASSES, resolvedSettings.nodeProgramClasses);
+  resolvedSettings.edgeProgramClasses = data.assign({}, DEFAULT_EDGE_PROGRAM_CLASSES, resolvedSettings.edgeProgramClasses);
+  return resolvedSettings;
+}
+
+exports.DEFAULT_EDGE_PROGRAM_CLASSES = DEFAULT_EDGE_PROGRAM_CLASSES;
+exports.DEFAULT_NODE_PROGRAM_CLASSES = DEFAULT_NODE_PROGRAM_CLASSES;
+exports.DEFAULT_SETTINGS = DEFAULT_SETTINGS;
+exports.resolveSettings = resolveSettings;
+exports.validateSettings = validateSettings;