feat: Phase 1 — extract the client (web SPA + desktop) to dtoro/oikos-web

Problem: the hexagonal refactor churns the backend tree for nine more
phases; the UI delivery stack (web/ SPA, cmd/desktop Wails wrapper,
compose/web image) must move to its own repo first so doc/layout
rewrites land once on a backend-only tree.

Change:
- New repo git.hubris.network/dtoro/oikos-web (v0.33.0): web/, desktop/
  (updateURL repointed to oikos-web releases), compose/, own CI (web +
  desktop jobs), own deploy script (CI-green gate, TOCTOU guard,
  version-tagged images, prune-to-3), own webhook receiver on :9798 +
  launchd unit, own compose project publishing the same 8091:80.
- Cutover executed on mac-mini in order: oikos stack's web service
  stopped+removed, oikos-web project brought up on 8091; outer Caddy
  untouched (targets the published port) — serving + Authentik flow +
  /wails 404 quirk verified post-cutover.
- Stripped from oikos: web/, cmd/desktop/, compose/web/, desktop CI
  workflow, ci.yml web job, Makefile ui/desktop/desktop-package/install
  targets, the compose web service, oikos-web from deploy.sh's fallback
  prune list; wails + go-keyring dropped from go.mod, vendor synced.
- README / CONTRIBUTING / AGENTS.md / .agents dev+operations docs now
  point at the new repo; mbse + mascot design docs carry a path note.

Risk: production SPA serving depends on the new pipeline now; rollback
is versioned-image re-up of the old web service from a pre-split
checkout (port 8091). Desktop builds installed before the split still
check dtoro/oikos releases — one manual reinstall, noted in the
oikos-web release notes.

Verification: go vet, make test (race), make generate-check, golangci
(no new findings; baseline down 400→365); post-cutover curls —
localhost:8091 200, /wails/runtime.js 404, outer Caddy 302 Authentik.

web/node_modules/vite-node/dist/cli.cjs

@@ -0,0 +1,141 @@
+'use strict';
+
+var path = require('node:path');
+var cac = require('cac');
+var browser = require('./chunk-browser.cjs');
+var vite = require('vite');
+var client = require('./client.cjs');
+var server = require('./server.cjs');
+var sourceMap = require('./source-map.cjs');
+var utils = require('./utils.cjs');
+var hmr = require('./chunk-hmr.cjs');
+require('node:module');
+require('node:url');
+require('node:vm');
+require('debug');
+require('pathe');
+require('node:fs');
+require('node:assert');
+require('node:perf_hooks');
+require('es-module-lexer');
+require('./constants.cjs');
+require('node:events');
+
+var version = "2.1.9";
+
+const cli = cac("vite-node");
+cli.option("-r, --root <path>", "Use specified root directory").option("-c, --config <path>", "Use specified config file").option("-m, --mode <mode>", "Set env mode").option("-w, --watch", 'Restart on file changes, similar to "nodemon"').option("--script", "Use vite-node as a script runner").option("--options <options>", "Use specified Vite server options").option("-v, --version", "Output the version number").option("-h, --help", "Display help for command");
+cli.command("[...files]").allowUnknownOptions().action(run);
+cli.parse(process.argv, { run: false });
+if (cli.args.length === 0) {
+  cli.runMatchedCommand();
+} else {
+  const i = cli.rawArgs.indexOf(cli.args[0]) + 1;
+  const scriptArgs = cli.rawArgs.slice(i).filter((it) => it !== "--");
+  const executeArgs = [...cli.rawArgs.slice(0, i), "--", ...scriptArgs];
+  cli.parse(executeArgs);
+}
+async function run(files, options = {}) {
+  var _a, _b;
+  if (options.script) {
+    files = [files[0]];
+    options = {};
+    process.argv = [
+      process.argv[0],
+      path.resolve(files[0]),
+      ...process.argv.slice(2).filter((arg) => arg !== "--script" && arg !== files[0])
+    ];
+  } else {
+    process.argv = [...process.argv.slice(0, 2), ...options["--"] || []];
+  }
+  if (options.version) {
+    cli.version(version);
+    cli.outputVersion();
+    process.exit(0);
+  }
+  if (options.help) {
+    cli.version(version).outputHelp();
+    process.exit(0);
+  }
+  if (!files.length) {
+    console.error(browser.f.red("No files specified."));
+    cli.version(version).outputHelp();
+    process.exit(1);
+  }
+  const serverOptions = options.options ? parseServerOptions(options.options) : {};
+  const server$1 = await vite.createServer({
+    logLevel: "error",
+    configFile: options.config,
+    root: options.root,
+    mode: options.mode,
+    server: {
+      hmr: !!options.watch,
+      watch: options.watch ? void 0 : null
+    },
+    plugins: [options.watch && hmr.viteNodeHmrPlugin()]
+  });
+  await server$1.pluginContainer.buildStart({});
+  const env = vite.loadEnv(server$1.config.mode, server$1.config.envDir, "");
+  for (const key in env) {
+    (_a = process.env)[key] ?? (_a[key] = env[key]);
+  }
+  const node = new server.ViteNodeServer(server$1, serverOptions);
+  sourceMap.installSourcemapsSupport({
+    getSourceMap: (source) => node.getSourceMap(source)
+  });
+  const runner = new client.ViteNodeRunner({
+    root: server$1.config.root,
+    base: server$1.config.base,
+    fetchModule(id) {
+      return node.fetchModule(id);
+    },
+    resolveId(id, importer) {
+      return node.resolveId(id, importer);
+    },
+    createHotContext(runner2, url) {
+      return hmr.createHotContext(runner2, server$1.emitter, files, url);
+    }
+  });
+  await runner.executeId("/@vite/env");
+  for (const file of files) {
+    await runner.executeFile(file);
+  }
+  if (!options.watch) {
+    await server$1.close();
+  }
+  (_b = server$1.emitter) == null ? void 0 : _b.on("message", (payload) => {
+    hmr.handleMessage(runner, server$1.emitter, files, payload);
+  });
+  if (options.watch) {
+    process.on("uncaughtException", (err) => {
+      console.error(browser.f.red("[vite-node] Failed to execute file: \n"), err);
+    });
+  }
+}
+function parseServerOptions(serverOptions) {
+  var _a, _b, _c, _d, _e, _f, _g, _h;
+  const inlineOptions = ((_a = serverOptions.deps) == null ? void 0 : _a.inline) === true ? true : utils.toArray((_b = serverOptions.deps) == null ? void 0 : _b.inline);
+  return {
+    ...serverOptions,
+    deps: {
+      ...serverOptions.deps,
+      inlineFiles: utils.toArray((_c = serverOptions.deps) == null ? void 0 : _c.inlineFiles),
+      inline: inlineOptions !== true ? inlineOptions.map((dep) => {
+        return dep.startsWith("/") && dep.endsWith("/") ? new RegExp(dep) : dep;
+      }) : true,
+      external: utils.toArray((_d = serverOptions.deps) == null ? void 0 : _d.external).map((dep) => {
+        return dep.startsWith("/") && dep.endsWith("/") ? new RegExp(dep) : dep;
+      }),
+      moduleDirectories: ((_e = serverOptions.deps) == null ? void 0 : _e.moduleDirectories) ? utils.toArray((_f = serverOptions.deps) == null ? void 0 : _f.moduleDirectories) : void 0
+    },
+    transformMode: {
+      ...serverOptions.transformMode,
+      ssr: utils.toArray((_g = serverOptions.transformMode) == null ? void 0 : _g.ssr).map(
+        (dep) => new RegExp(dep)
+      ),
+      web: utils.toArray((_h = serverOptions.transformMode) == null ? void 0 : _h.web).map(
+        (dep) => new RegExp(dep)
+      )
+    }
+  };
+}