feat: Phase 1 — extract the client (web SPA + desktop) to dtoro/oikos-web

Problem: the hexagonal refactor churns the backend tree for nine more
phases; the UI delivery stack (web/ SPA, cmd/desktop Wails wrapper,
compose/web image) must move to its own repo first so doc/layout
rewrites land once on a backend-only tree.

Change:
- New repo git.hubris.network/dtoro/oikos-web (v0.33.0): web/, desktop/
  (updateURL repointed to oikos-web releases), compose/, own CI (web +
  desktop jobs), own deploy script (CI-green gate, TOCTOU guard,
  version-tagged images, prune-to-3), own webhook receiver on :9798 +
  launchd unit, own compose project publishing the same 8091:80.
- Cutover executed on mac-mini in order: oikos stack's web service
  stopped+removed, oikos-web project brought up on 8091; outer Caddy
  untouched (targets the published port) — serving + Authentik flow +
  /wails 404 quirk verified post-cutover.
- Stripped from oikos: web/, cmd/desktop/, compose/web/, desktop CI
  workflow, ci.yml web job, Makefile ui/desktop/desktop-package/install
  targets, the compose web service, oikos-web from deploy.sh's fallback
  prune list; wails + go-keyring dropped from go.mod, vendor synced.
- README / CONTRIBUTING / AGENTS.md / .agents dev+operations docs now
  point at the new repo; mbse + mascot design docs carry a path note.

Risk: production SPA serving depends on the new pipeline now; rollback
is versioned-image re-up of the old web service from a pre-split
checkout (port 8091). Desktop builds installed before the split still
check dtoro/oikos releases — one manual reinstall, noted in the
oikos-web release notes.

Verification: go vet, make test (race), make generate-check, golangci
(no new findings; baseline down 400→365); post-cutover curls —
localhost:8091 200, /wails/runtime.js 404, outer Caddy 302 Authentik.

web/node_modules/style-to-object/README.md

@@ -0,0 +1,188 @@
+# style-to-object
+
+[![NPM](https://nodei.co/npm/style-to-object.png)](https://nodei.co/npm/style-to-object/)
+
+[![NPM version](https://img.shields.io/npm/v/style-to-object)](https://www.npmjs.com/package/style-to-object)
+[![NPM bundle size](https://img.shields.io/bundlephobia/minzip/style-to-object)](https://bundlephobia.com/package/style-to-object)
+[![build](https://github.com/remarkablemark/style-to-object/actions/workflows/build.yml/badge.svg)](https://github.com/remarkablemark/style-to-object/actions/workflows/build.yml)
+[![codecov](https://codecov.io/gh/remarkablemark/style-to-object/branch/master/graph/badge.svg?token=XWxph9dpa4)](https://codecov.io/gh/remarkablemark/style-to-object)
+[![NPM downloads](https://img.shields.io/npm/dm/style-to-object)](https://www.npmjs.com/package/style-to-object)
+
+Parse CSS inline style to JavaScript object:
+
+```js
+import parse from 'style-to-object';
+
+parse('color: #C0FFEE; background: #BADA55;');
+```
+
+Output:
+
+```js
+{ color: '#C0FFEE', background: '#BADA55' }
+```
+
+[JSFiddle](https://jsfiddle.net/remarkablemark/ykz2meot/) | [Examples](https://github.com/remarkablemark/style-to-object/tree/master/examples)
+
+## Installation
+
+[NPM](https://www.npmjs.com/package/style-to-object):
+
+```sh
+npm install style-to-object --save
+```
+
+[Yarn](https://yarn.fyi/style-to-object):
+
+```sh
+yarn add style-to-object
+```
+
+[CDN](https://unpkg.com/style-to-object/):
+
+```html
+<script src="https://unpkg.com/style-to-object@latest/dist/style-to-object.min.js"></script>
+<script>
+  window.StyleToObject(/* string */);
+</script>
+```
+
+## Usage
+
+Import with ES Modules:
+
+```js
+import parse from 'style-to-object';
+```
+
+Require with CommonJS:
+
+```js
+const parse = require('style-to-object').default;
+```
+
+Parse single declaration:
+
+```js
+parse('line-height: 42');
+```
+
+Output:
+
+```js
+{ 'line-height': '42' }
+```
+
+Parse multiple declarations:
+
+```js
+parse(`
+  border-color: #ACE;
+  z-index: 1337;
+`);
+```
+
+Output:
+
+```js
+{ 'border-color': '#ACE', 'z-index': '1337' }
+```
+
+Parse unknown declarations:
+
+```js
+parse('answer: 42;');
+```
+
+Output:
+
+```js
+{ 'answer': '42' }
+```
+
+Invalid declarations/arguments:
+
+<!-- prettier-ignore-start -->
+
+```js
+parse(`
+  top: ;
+  right: 1em;
+`); // { right: '1em' }
+
+parse();        // null
+parse(null);    // null
+parse(1);       // null
+parse(true);    // null
+parse('top:');  // null
+parse(':12px'); // null
+parse(':');     // null
+parse(';');     // null
+
+parse('top'); // throws Error
+parse('/*');  // throws Error
+```
+
+<!-- prettier-ignore-end -->
+
+### Iterator
+
+If the 2nd argument is a function, then the parser will return `null`:
+
+```js
+parse('color: #f00', () => {}); // null
+```
+
+But the function will iterate through each declaration:
+
+<!-- prettier-ignore-start -->
+
+```js
+parse('color: #f00', (name, value, declaration) => {
+  console.log(name);        // 'color'
+  console.log(value);       // '#f00'
+  console.log(declaration); // { type: 'declaration', property: 'color', value: '#f00' }
+});
+```
+
+<!-- prettier-ignore-end -->
+
+This makes it easy to customize the output:
+
+```js
+const style = `
+  color: red;
+  background: blue;
+`;
+const output = [];
+
+function iterator(name, value) {
+  output.push([name, value]);
+}
+
+parse(style, iterator);
+console.log(output); // [['color', 'red'], ['background', 'blue']]
+```
+
+## Migration
+
+### v1
+
+Migrated to TypeScript. Iterator excludes `Comment`. CommonJS requires the `.default` key:
+
+```js
+const parse = require('style-to-object').default;
+```
+
+## Release
+
+Release and publish are automated by [Release Please](https://github.com/googleapis/release-please).
+
+## Special Thanks
+
+- [inline-style-parser](https://github.com/remarkablemark/inline-style-parser)
+- [Contributors](https://github.com/remarkablemark/style-to-object/graphs/contributors)
+
+## License
+
+[MIT](https://github.com/remarkablemark/style-to-object/blob/master/LICENSE)