feat: Phase 1 — extract the client (web SPA + desktop) to dtoro/oikos-web

Problem: the hexagonal refactor churns the backend tree for nine more
phases; the UI delivery stack (web/ SPA, cmd/desktop Wails wrapper,
compose/web image) must move to its own repo first so doc/layout
rewrites land once on a backend-only tree.

Change:
- New repo git.hubris.network/dtoro/oikos-web (v0.33.0): web/, desktop/
  (updateURL repointed to oikos-web releases), compose/, own CI (web +
  desktop jobs), own deploy script (CI-green gate, TOCTOU guard,
  version-tagged images, prune-to-3), own webhook receiver on :9798 +
  launchd unit, own compose project publishing the same 8091:80.
- Cutover executed on mac-mini in order: oikos stack's web service
  stopped+removed, oikos-web project brought up on 8091; outer Caddy
  untouched (targets the published port) — serving + Authentik flow +
  /wails 404 quirk verified post-cutover.
- Stripped from oikos: web/, cmd/desktop/, compose/web/, desktop CI
  workflow, ci.yml web job, Makefile ui/desktop/desktop-package/install
  targets, the compose web service, oikos-web from deploy.sh's fallback
  prune list; wails + go-keyring dropped from go.mod, vendor synced.
- README / CONTRIBUTING / AGENTS.md / .agents dev+operations docs now
  point at the new repo; mbse + mascot design docs carry a path note.

Risk: production SPA serving depends on the new pipeline now; rollback
is versioned-image re-up of the old web service from a pre-split
checkout (port 8091). Desktop builds installed before the split still
check dtoro/oikos releases — one manual reinstall, noted in the
oikos-web release notes.

Verification: go vet, make test (race), make generate-check, golangci
(no new findings; baseline down 400→365); post-cutover curls —
localhost:8091 200, /wails/runtime.js 404, outer Caddy 302 Authentik.

web/node_modules/svelte-splitpanes/dist/Pane.svelte

@@ -0,0 +1,108 @@
+<script lang="ts">import { getContext, onMount, onDestroy, hasContext } from 'svelte';
+import { KEY } from './Splitpanes.svelte';
+import { browser } from './internal/env.js';
+import { gatheringKey } from './internal/GatheringRound.svelte';
+import { getDimensionName } from './internal/utils/sizing.js';
+import { carefullCallbackSource } from './internal/utils/functions';
+const { ssrRegisterPaneSize, onPaneInit, clientOnly: clientOnlyContext, isHorizontal, showFirstSplitter, veryFirstPaneKey } = getContext(KEY);
+// PROPS
+export let size = null;
+export let minSize = 0;
+export let maxSize = 100;
+export let snapSize = 0;
+// css class
+let clazz = '';
+export { clazz as class };
+// VARIABLES
+const key = {};
+const gathering = !browser && hasContext(gatheringKey);
+const { undefinedPaneInitSize } = (!gathering ? onPaneInit(key) : {});
+let element;
+let sz = size ?? undefinedPaneInitSize;
+let isSplitterActive = false;
+// CALLBACKS
+let clientCallbacks = undefined;
+/**
+ * This is an object of callbacks that are safe to be called on browser even when the object `clientCallbacks`
+ *  isn't initialized yet (i.e. before `onPaneAdd()`).
+ *
+ * In the case of the object isn't initialized yet, calling this callbacks will do nothing.
+ */
+const carefullClientCallbacks = browser
+    ? carefullCallbackSource(() => clientCallbacks)
+    : undefined;
+const reportGivenSizeChangeSafe = (size) => {
+    // We put an extra check of `size != sz` here and not in the reactive statement, since we don't want a change
+    //  of `sz` to trigger report.
+    if (clientCallbacks && size != sz) {
+        carefullClientCallbacks?.('reportGivenSizeChange')(size);
+    }
+};
+// REACTIVE
+$: {
+    if (browser && typeof size === 'number') {
+        reportGivenSizeChangeSafe(size);
+    }
+}
+$: dimension = getDimensionName($isHorizontal);
+$: style = `${dimension}: ${sz}%;`;
+if (gathering && ssrRegisterPaneSize) {
+    ssrRegisterPaneSize(size);
+}
+else if (browser) {
+    onMount(() => {
+        const inst = {
+            index: 0,
+            key,
+            element: element,
+            givenSize: size,
+            sz: () => sz,
+            setSz: v => {
+                sz = v;
+                if (typeof size === 'number' && size !== sz) {
+                    size = sz;
+                }
+            },
+            min: () => minSize,
+            max: () => maxSize,
+            snap: () => snapSize,
+            setSplitterActive: (isActive) => {
+                isSplitterActive = isActive;
+            },
+            isReady: false
+        };
+        clientCallbacks = clientOnlyContext?.onPaneAdd(inst);
+    });
+    onDestroy(() => {
+        clientOnlyContext?.onPaneRemove(key);
+    });
+}
+</script>
+
+{#if !gathering}
+  <!-- Splitter -->
+  {#if $veryFirstPaneKey !== key || $showFirstSplitter}
+    <!-- this a11y issue is known, and will be taken care of as part of the a11y feature issue in #11 -->
+    <!-- svelte-ignore a11y-click-events-have-key-events -->
+    <!-- svelte-ignore a11y-no-static-element-interactions -->
+    <div
+      class="splitpanes__splitter {isSplitterActive ? 'splitpanes__splitter__active' : ''}"
+      on:mousedown={carefullClientCallbacks?.('onSplitterDown')}
+      on:touchstart={carefullClientCallbacks?.('onSplitterDown')}
+      on:click={carefullClientCallbacks?.('onSplitterClick')}
+      on:dblclick={carefullClientCallbacks?.('onSplitterDblClick')}>
+    </div>
+  {/if}
+
+  <!-- Pane -->
+  <!-- this a11y issue is known, and will be taken care of as part of the a11y feature issue in #11 -->
+  <!-- svelte-ignore a11y-click-events-have-key-events -->
+  <!-- svelte-ignore a11y-no-static-element-interactions -->
+  <div
+    class={`splitpanes__pane ${clazz || ''}`}
+    bind:this={element}
+    on:click={carefullClientCallbacks?.('onPaneClick')}
+    {style}>
+    <slot />
+  </div>
+{/if}