feat: Phase 1 — extract the client (web SPA + desktop) to dtoro/oikos-web

Problem: the hexagonal refactor churns the backend tree for nine more
phases; the UI delivery stack (web/ SPA, cmd/desktop Wails wrapper,
compose/web image) must move to its own repo first so doc/layout
rewrites land once on a backend-only tree.

Change:
- New repo git.hubris.network/dtoro/oikos-web (v0.33.0): web/, desktop/
  (updateURL repointed to oikos-web releases), compose/, own CI (web +
  desktop jobs), own deploy script (CI-green gate, TOCTOU guard,
  version-tagged images, prune-to-3), own webhook receiver on :9798 +
  launchd unit, own compose project publishing the same 8091:80.
- Cutover executed on mac-mini in order: oikos stack's web service
  stopped+removed, oikos-web project brought up on 8091; outer Caddy
  untouched (targets the published port) — serving + Authentik flow +
  /wails 404 quirk verified post-cutover.
- Stripped from oikos: web/, cmd/desktop/, compose/web/, desktop CI
  workflow, ci.yml web job, Makefile ui/desktop/desktop-package/install
  targets, the compose web service, oikos-web from deploy.sh's fallback
  prune list; wails + go-keyring dropped from go.mod, vendor synced.
- README / CONTRIBUTING / AGENTS.md / .agents dev+operations docs now
  point at the new repo; mbse + mascot design docs carry a path note.

Risk: production SPA serving depends on the new pipeline now; rollback
is versioned-image re-up of the old web service from a pre-split
checkout (port 8091). Desktop builds installed before the split still
check dtoro/oikos releases — one manual reinstall, noted in the
oikos-web release notes.

Verification: go vet, make test (race), make generate-check, golangci
(no new findings; baseline down 400→365); post-cutover curls —
localhost:8091 200, /wails/runtime.js 404, outer Caddy 302 Authentik.

web/node_modules/svelte-eslint-parser/lib/context/script-let.d.ts

@@ -0,0 +1,91 @@
+import type { ScopeManager, Scope } from "eslint-scope";
+import type * as ESTree from "estree";
+import type { TSESTree } from "@typescript-eslint/types";
+import type { Context } from ".";
+import type { Comment, SvelteEachBlock, SvelteIfBlock, SvelteName, SvelteNode, SvelteSnippetBlock, Token } from "../ast";
+import type { ESLintExtendedProgram } from "../parser";
+export type ScriptLetCallback<E extends ESTree.Node> = (es: E, options: ScriptLetCallbackOption) => void;
+export type ScriptLetCallbackOption = {
+    getScope: (node: ESTree.Node) => Scope;
+    registerNodeToScope: (node: any, scope: Scope) => void;
+    scopeManager: ScopeManager;
+    visitorKeys?: {
+        [type: string]: string[];
+    };
+};
+export type ScriptLetRestoreCallback = (node: ESTree.Node, tokens: Token[], comments: Comment[], options: ScriptLetRestoreCallbackOption) => void;
+type ScriptLetRestoreCallbackOption = {
+    getScope: (node: ESTree.Node) => Scope;
+    registerNodeToScope: (node: any, scope: Scope) => void;
+    scopeManager: ScopeManager;
+    visitorKeys?: {
+        [type: string]: string[];
+    };
+    addPostProcess: (callback: () => void) => void;
+};
+type StatementNodeType = `${TSESTree.Statement["type"]}`;
+type TypeGenHelper = {
+    generateUniqueId: (base: string) => string;
+};
+type ObjectShorthandProperty = ESTree.Property & {
+    key: ESTree.Identifier;
+    value: ESTree.Identifier;
+};
+export type ScriptLetBlockParam = {
+    node: ESTree.Pattern | SvelteName;
+    parent: SvelteNode;
+    typing: string;
+    callback: (node: ESTree.Pattern, options: ScriptLetCallbackOption) => void;
+};
+/**
+ * A class that handles script fragments.
+ * The script fragment AST node remaps and connects to the original directive AST node.
+ */
+export declare class ScriptLetContext {
+    private readonly script;
+    private readonly ctx;
+    private readonly restoreCallbacks;
+    private readonly programRestoreCallbacks;
+    private readonly closeScopeCallbacks;
+    private readonly unique;
+    private currentScriptScopeKind;
+    constructor(ctx: Context);
+    addExpression<E extends ESTree.Expression>(expression: E | SvelteName, parent: SvelteNode, typing?: string | null, ...callbacks: ScriptLetCallback<E>[]): ScriptLetCallback<E>[];
+    addExpressionFromRange<E extends ESTree.Expression>(range: [number, number], parent: SvelteNode, typing?: string | null, ...callbacks: ScriptLetCallback<E>[]): ScriptLetCallback<E>[];
+    addObjectShorthandProperty(identifier: SvelteName, parent: SvelteNode, ...callbacks: ScriptLetCallback<ObjectShorthandProperty>[]): void;
+    addVariableDeclarator(declarator: ESTree.VariableDeclarator | ESTree.AssignmentExpression, parent: SvelteNode, ...callbacks: ScriptLetCallback<ESTree.VariableDeclarator>[]): ScriptLetCallback<ESTree.VariableDeclarator>[];
+    addGenericTypeAliasDeclaration(param: TSESTree.TSTypeParameter, callbackId: (id: TSESTree.Identifier, type: TSESTree.TypeNode) => void, callbackDefault: (type: TSESTree.TypeNode) => void): void;
+    nestIfBlock(expression: ESTree.Expression, ifBlock: SvelteIfBlock, callback: ScriptLetCallback<ESTree.Expression>): void;
+    nestEachBlock(expression: ESTree.Expression, context: ESTree.Pattern, indexRange: {
+        start: number;
+        end: number;
+    } | null, eachBlock: SvelteEachBlock, callback: (expr: ESTree.Expression, ctx: ESTree.Pattern, index: ESTree.Identifier | null) => void): void;
+    nestSnippetBlock(id: ESTree.Identifier, closeParentIndex: number, snippetBlock: SvelteSnippetBlock, kind: "snippet" | null, callback: (id: ESTree.Identifier, params: ESTree.Pattern[]) => void): void;
+    nestBlock(block: SvelteNode, params?: ScriptLetBlockParam[] | ((helper: TypeGenHelper | null) => {
+        param: ScriptLetBlockParam;
+        preparationScript?: {
+            script: string;
+            nodeType: StatementNodeType;
+        }[];
+    })): void;
+    closeScope(): void;
+    addProgramRestore(callback: ScriptLetRestoreCallback): void;
+    private appendScript;
+    private appendScriptWithoutOffset;
+    private pushScope;
+    /**
+     * Restore AST nodes
+     */
+    restore(result: ESLintExtendedProgram): void;
+    /**
+     * Restore AST nodes
+     */
+    private restoreNodes;
+    /**
+     * Restore program node
+     */
+    private restoreProgram;
+    private remapNodes;
+    private generateUniqueId;
+}
+export {};