feat: Phase 1 — extract the client (web SPA + desktop) to dtoro/oikos-web

Problem: the hexagonal refactor churns the backend tree for nine more
phases; the UI delivery stack (web/ SPA, cmd/desktop Wails wrapper,
compose/web image) must move to its own repo first so doc/layout
rewrites land once on a backend-only tree.

Change:
- New repo git.hubris.network/dtoro/oikos-web (v0.33.0): web/, desktop/
  (updateURL repointed to oikos-web releases), compose/, own CI (web +
  desktop jobs), own deploy script (CI-green gate, TOCTOU guard,
  version-tagged images, prune-to-3), own webhook receiver on :9798 +
  launchd unit, own compose project publishing the same 8091:80.
- Cutover executed on mac-mini in order: oikos stack's web service
  stopped+removed, oikos-web project brought up on 8091; outer Caddy
  untouched (targets the published port) — serving + Authentik flow +
  /wails 404 quirk verified post-cutover.
- Stripped from oikos: web/, cmd/desktop/, compose/web/, desktop CI
  workflow, ci.yml web job, Makefile ui/desktop/desktop-package/install
  targets, the compose web service, oikos-web from deploy.sh's fallback
  prune list; wails + go-keyring dropped from go.mod, vendor synced.
- README / CONTRIBUTING / AGENTS.md / .agents dev+operations docs now
  point at the new repo; mbse + mascot design docs carry a path note.

Risk: production SPA serving depends on the new pipeline now; rollback
is versioned-image re-up of the old web service from a pre-split
checkout (port 8091). Desktop builds installed before the split still
check dtoro/oikos releases — one manual reinstall, noted in the
oikos-web release notes.

Verification: go vet, make test (race), make generate-check, golangci
(no new findings; baseline down 400→365); post-cutover curls —
localhost:8091 200, /wails/runtime.js 404, outer Caddy 302 Authentik.

web/node_modules/vite/index.cjs

@@ -0,0 +1,96 @@
+const description =
+  ' See https://vite.dev/guide/troubleshooting.html#vite-cjs-node-api-deprecated for more details.'
+
+warnCjsUsage()
+
+// type utils
+module.exports.defineConfig = (config) => config
+
+// proxy cjs utils (sync functions)
+Object.assign(module.exports, require('./dist/node-cjs/publicUtils.cjs'))
+
+// async functions, can be redirect from ESM build
+const asyncFunctions = [
+  'build',
+  'createServer',
+  'preview',
+  'transformWithEsbuild',
+  'resolveConfig',
+  'optimizeDeps',
+  'formatPostcssSourceMap',
+  'loadConfigFromFile',
+  'preprocessCSS',
+  'createBuilder',
+  'runnerImport',
+]
+asyncFunctions.forEach((name) => {
+  module.exports[name] = (...args) =>
+    import('./dist/node/index.js').then((i) => i[name](...args))
+})
+
+// variables and sync functions that cannot be used from cjs build
+const disallowedVariables = [
+  // was not exposed in cjs from the beginning
+  'parseAst',
+  'parseAstAsync',
+  'buildErrorMessage',
+  'sortUserPlugins',
+  // Environment API related variables that are too big to include in the cjs build
+  'DevEnvironment',
+  'BuildEnvironment',
+  'createIdResolver',
+  'createRunnableDevEnvironment',
+  // can be redirected from ESM, but doesn't make sense as it's Environment API related
+  'fetchModule',
+  'moduleRunnerTransform',
+  // can be exposed, but doesn't make sense as it's Environment API related
+  'createServerHotChannel',
+  'createServerModuleRunner',
+  'createServerModuleRunnerTransport',
+  'isRunnableDevEnvironment',
+  'createFetchableDevEnvironment',
+  'isFetchableDevEnvironment',
+]
+disallowedVariables.forEach((name) => {
+  Object.defineProperty(module.exports, name, {
+    get() {
+      throw new Error(
+        `${name} is not available in the CJS build of Vite.` + description,
+      )
+    },
+  })
+})
+
+function warnCjsUsage() {
+  if (process.env.VITE_CJS_IGNORE_WARNING) return
+  const logLevelIndex = process.argv.findIndex((arg) =>
+    /^(?:-l|--logLevel)/.test(arg),
+  )
+  if (logLevelIndex > 0) {
+    const logLevelValue = process.argv[logLevelIndex + 1]
+    if (logLevelValue === 'silent' || logLevelValue === 'error') {
+      return
+    }
+    if (/silent|error/.test(process.argv[logLevelIndex])) {
+      return
+    }
+  }
+  const yellow = (str) => `\u001b[33m${str}\u001b[39m`
+  console.warn(
+    yellow("The CJS build of Vite's Node API is deprecated." + description),
+  )
+  if (process.env.VITE_CJS_TRACE) {
+    const e = {}
+    const stackTraceLimit = Error.stackTraceLimit
+    Error.stackTraceLimit = 100
+    Error.captureStackTrace(e)
+    Error.stackTraceLimit = stackTraceLimit
+    console.log(
+      e.stack
+        .split('\n')
+        .slice(1)
+        .filter((line) => !line.includes('(node:'))
+        .join('\n'),
+    )
+  }
+}