feat: Phase 1 — extract the client (web SPA + desktop) to dtoro/oikos-web

Problem: the hexagonal refactor churns the backend tree for nine more
phases; the UI delivery stack (web/ SPA, cmd/desktop Wails wrapper,
compose/web image) must move to its own repo first so doc/layout
rewrites land once on a backend-only tree.

Change:
- New repo git.hubris.network/dtoro/oikos-web (v0.33.0): web/, desktop/
  (updateURL repointed to oikos-web releases), compose/, own CI (web +
  desktop jobs), own deploy script (CI-green gate, TOCTOU guard,
  version-tagged images, prune-to-3), own webhook receiver on :9798 +
  launchd unit, own compose project publishing the same 8091:80.
- Cutover executed on mac-mini in order: oikos stack's web service
  stopped+removed, oikos-web project brought up on 8091; outer Caddy
  untouched (targets the published port) — serving + Authentik flow +
  /wails 404 quirk verified post-cutover.
- Stripped from oikos: web/, cmd/desktop/, compose/web/, desktop CI
  workflow, ci.yml web job, Makefile ui/desktop/desktop-package/install
  targets, the compose web service, oikos-web from deploy.sh's fallback
  prune list; wails + go-keyring dropped from go.mod, vendor synced.
- README / CONTRIBUTING / AGENTS.md / .agents dev+operations docs now
  point at the new repo; mbse + mascot design docs carry a path note.

Risk: production SPA serving depends on the new pipeline now; rollback
is versioned-image re-up of the old web service from a pre-split
checkout (port 8091). Desktop builds installed before the split still
check dtoro/oikos releases — one manual reinstall, noted in the
oikos-web release notes.

Verification: go vet, make test (race), make generate-check, golangci
(no new findings; baseline down 400→365); post-cutover curls —
localhost:8091 200, /wails/runtime.js 404, outer Caddy 302 Authentik.

web/node_modules/tailwind-merge/src/lib/validators.ts

@@ -0,0 +1,144 @@
+const arbitraryValueRegex = /^\[(?:(\w[\w-]*):)?(.+)\]$/i
+const arbitraryVariableRegex = /^\((?:(\w[\w-]*):)?(.+)\)$/i
+const fractionRegex = /^\d+(?:\.\d+)?\/\d+(?:\.\d+)?$/
+const tshirtUnitRegex = /^(\d+(\.\d+)?)?(xs|sm|md|lg|xl)$/
+const lengthUnitRegex =
+    /\d+(%|px|r?em|[sdl]?v([hwib]|min|max)|pt|pc|in|cm|mm|cap|ch|ex|r?lh|cq(w|h|i|b|min|max))|\b(calc|min|max|clamp)\(.+\)|^0$/
+const colorFunctionRegex = /^(rgba?|hsla?|hwb|(ok)?(lab|lch)|color-mix)\(.+\)$/
+// Shadow always begins with x and y offset separated by underscore optionally prepended by inset
+const shadowRegex = /^(inset_)?-?((\d+)?\.?(\d+)[a-z]+|0)_-?((\d+)?\.?(\d+)[a-z]+|0)/
+const imageRegex =
+    /^(url|image|image-set|cross-fade|element|(repeating-)?(linear|radial|conic)-gradient)\(.+\)$/
+
+export const isFraction = (value: string) => fractionRegex.test(value)
+
+export const isNumber = (value: string) => !!value && !Number.isNaN(Number(value))
+
+export const isInteger = (value: string) => !!value && Number.isInteger(Number(value))
+
+export const isPercent = (value: string) => value.endsWith('%') && isNumber(value.slice(0, -1))
+
+export const isTshirtSize = (value: string) => tshirtUnitRegex.test(value)
+
+export const isAny = () => true
+
+const isLengthOnly = (value: string) =>
+    // `colorFunctionRegex` check is necessary because color functions can have percentages in them which which would be incorrectly classified as lengths.
+    // For example, `hsl(0 0% 0%)` would be classified as a length without this check.
+    // I could also use lookbehind assertion in `lengthUnitRegex` but that isn't supported widely enough.
+    lengthUnitRegex.test(value) && !colorFunctionRegex.test(value)
+
+const isNever = () => false
+
+const isShadow = (value: string) => shadowRegex.test(value)
+
+const isImage = (value: string) => imageRegex.test(value)
+
+export const isAnyNonArbitrary = (value: string) =>
+    !isArbitraryValue(value) && !isArbitraryVariable(value)
+
+export const isNamedContainerQuery = (value: string) =>
+    value.startsWith('@container') &&
+    ((value[10] === '/' && value[11] !== undefined) ||
+        (value[11] === 's' && value[16] !== undefined && value.startsWith('-size/', 10)) ||
+        (value[11] === 'n' && value[18] !== undefined && value.startsWith('-normal/', 10)))
+
+export const isArbitrarySize = (value: string) => getIsArbitraryValue(value, isLabelSize, isNever)
+
+export const isArbitraryValue = (value: string) => arbitraryValueRegex.test(value)
+
+export const isArbitraryLength = (value: string) =>
+    getIsArbitraryValue(value, isLabelLength, isLengthOnly)
+
+export const isArbitraryNumber = (value: string) =>
+    getIsArbitraryValue(value, isLabelNumber, isNumber)
+
+export const isArbitraryWeight = (value: string) => getIsArbitraryValue(value, isLabelWeight, isAny)
+
+export const isArbitraryFamilyName = (value: string) =>
+    getIsArbitraryValue(value, isLabelFamilyName, isNever)
+
+export const isArbitraryPosition = (value: string) =>
+    getIsArbitraryValue(value, isLabelPosition, isNever)
+
+export const isArbitraryImage = (value: string) => getIsArbitraryValue(value, isLabelImage, isImage)
+
+export const isArbitraryShadow = (value: string) =>
+    getIsArbitraryValue(value, isLabelShadow, isShadow)
+
+export const isArbitraryVariable = (value: string) => arbitraryVariableRegex.test(value)
+
+export const isArbitraryVariableLength = (value: string) =>
+    getIsArbitraryVariable(value, isLabelLength)
+
+export const isArbitraryVariableFamilyName = (value: string) =>
+    getIsArbitraryVariable(value, isLabelFamilyName)
+
+export const isArbitraryVariablePosition = (value: string) =>
+    getIsArbitraryVariable(value, isLabelPosition)
+
+export const isArbitraryVariableSize = (value: string) => getIsArbitraryVariable(value, isLabelSize)
+
+export const isArbitraryVariableImage = (value: string) =>
+    getIsArbitraryVariable(value, isLabelImage)
+
+export const isArbitraryVariableShadow = (value: string) =>
+    getIsArbitraryVariable(value, isLabelShadow, true)
+
+export const isArbitraryVariableWeight = (value: string) =>
+    getIsArbitraryVariable(value, isLabelWeight, true)
+
+// Helpers
+
+const getIsArbitraryValue = (
+    value: string,
+    testLabel: (label: string) => boolean,
+    testValue: (value: string) => boolean,
+) => {
+    const result = arbitraryValueRegex.exec(value)
+
+    if (result) {
+        if (result[1]) {
+            return testLabel(result[1])
+        }
+
+        return testValue(result[2]!)
+    }
+
+    return false
+}
+
+const getIsArbitraryVariable = (
+    value: string,
+    testLabel: (label: string) => boolean,
+    shouldMatchNoLabel = false,
+) => {
+    const result = arbitraryVariableRegex.exec(value)
+
+    if (result) {
+        if (result[1]) {
+            return testLabel(result[1])
+        }
+        return shouldMatchNoLabel
+    }
+
+    return false
+}
+
+// Labels
+
+const isLabelPosition = (label: string) => label === 'position' || label === 'percentage'
+
+const isLabelImage = (label: string) => label === 'image' || label === 'url'
+
+const isLabelSize = (label: string) => label === 'length' || label === 'size' || label === 'bg-size'
+
+const isLabelLength = (label: string) => label === 'length'
+
+const isLabelNumber = (label: string) => label === 'number'
+
+const isLabelFamilyName = (label: string) => label === 'family-name'
+
+const isLabelWeight = (label: string) => label === 'number' || label === 'weight'
+
+const isLabelShadow = (label: string) => label === 'shadow'