feat: Phase 1 — extract the client (web SPA + desktop) to dtoro/oikos-web

Problem: the hexagonal refactor churns the backend tree for nine more
phases; the UI delivery stack (web/ SPA, cmd/desktop Wails wrapper,
compose/web image) must move to its own repo first so doc/layout
rewrites land once on a backend-only tree.

Change:
- New repo git.hubris.network/dtoro/oikos-web (v0.33.0): web/, desktop/
  (updateURL repointed to oikos-web releases), compose/, own CI (web +
  desktop jobs), own deploy script (CI-green gate, TOCTOU guard,
  version-tagged images, prune-to-3), own webhook receiver on :9798 +
  launchd unit, own compose project publishing the same 8091:80.
- Cutover executed on mac-mini in order: oikos stack's web service
  stopped+removed, oikos-web project brought up on 8091; outer Caddy
  untouched (targets the published port) — serving + Authentik flow +
  /wails 404 quirk verified post-cutover.
- Stripped from oikos: web/, cmd/desktop/, compose/web/, desktop CI
  workflow, ci.yml web job, Makefile ui/desktop/desktop-package/install
  targets, the compose web service, oikos-web from deploy.sh's fallback
  prune list; wails + go-keyring dropped from go.mod, vendor synced.
- README / CONTRIBUTING / AGENTS.md / .agents dev+operations docs now
  point at the new repo; mbse + mascot design docs carry a path note.

Risk: production SPA serving depends on the new pipeline now; rollback
is versioned-image re-up of the old web service from a pre-split
checkout (port 8091). Desktop builds installed before the split still
check dtoro/oikos releases — one manual reinstall, noted in the
oikos-web release notes.

Verification: go vet, make test (race), make generate-check, golangci
(no new findings; baseline down 400→365); post-cutover curls —
localhost:8091 200, /wails/runtime.js 404, outer Caddy 302 Authentik.

web/node_modules/vitest/dist/chunks/index.nEwtF0bu.js

@@ -0,0 +1,107 @@
+import * as chai from 'chai';
+import { resolve } from 'node:path';
+import { t as takeCoverageInsideWorker } from './coverage.BoMDb1ip.js';
+import { distDir } from '../path.js';
+import { r as rpc } from './rpc.C3q9uwRX.js';
+import { l as loadDiffConfig, a as loadSnapshotSerializers } from './setup-common.Dj6BZI3u.js';
+import { g as getWorkerState } from './utils.C8RiOc4B.js';
+
+function setupChaiConfig(config) {
+  Object.assign(chai.config, config);
+}
+
+async function resolveSnapshotEnvironment(config, executor) {
+  if (!config.snapshotEnvironment) {
+    const { VitestNodeSnapshotEnvironment } = await import('./node.AKq966Jp.js');
+    return new VitestNodeSnapshotEnvironment();
+  }
+  const mod = await executor.executeId(config.snapshotEnvironment);
+  if (typeof mod.default !== "object" || !mod.default) {
+    throw new Error(
+      "Snapshot environment module must have a default export object with a shape of `SnapshotEnvironment`"
+    );
+  }
+  return mod.default;
+}
+
+const runnersFile = resolve(distDir, "runners.js");
+async function getTestRunnerConstructor(config, executor) {
+  if (!config.runner) {
+    const { VitestTestRunner, NodeBenchmarkRunner } = await executor.executeFile(runnersFile);
+    return config.mode === "test" ? VitestTestRunner : NodeBenchmarkRunner;
+  }
+  const mod = await executor.executeId(config.runner);
+  if (!mod.default && typeof mod.default !== "function") {
+    throw new Error(
+      `Runner must export a default function, but got ${typeof mod.default} imported from ${config.runner}`
+    );
+  }
+  return mod.default;
+}
+async function resolveTestRunner(config, executor) {
+  const TestRunner = await getTestRunnerConstructor(config, executor);
+  const testRunner = new TestRunner(config);
+  Object.defineProperty(testRunner, "__vitest_executor", {
+    value: executor,
+    enumerable: false,
+    configurable: false
+  });
+  if (!testRunner.config) {
+    testRunner.config = config;
+  }
+  if (!testRunner.importFile) {
+    throw new Error('Runner must implement "importFile" method.');
+  }
+  const [diffOptions] = await Promise.all([
+    loadDiffConfig(config, executor),
+    loadSnapshotSerializers(config, executor)
+  ]);
+  testRunner.config.diffOptions = diffOptions;
+  const originalOnTaskUpdate = testRunner.onTaskUpdate;
+  testRunner.onTaskUpdate = async (task) => {
+    const p = rpc().onTaskUpdate(task);
+    await originalOnTaskUpdate?.call(testRunner, task);
+    return p;
+  };
+  const originalOnCollected = testRunner.onCollected;
+  testRunner.onCollected = async (files) => {
+    const state = getWorkerState();
+    files.forEach((file) => {
+      file.prepareDuration = state.durations.prepare;
+      file.environmentLoad = state.durations.environment;
+      state.durations.prepare = 0;
+      state.durations.environment = 0;
+    });
+    rpc().onCollected(files);
+    await originalOnCollected?.call(testRunner, files);
+  };
+  const originalOnAfterRun = testRunner.onAfterRunFiles;
+  testRunner.onAfterRunFiles = async (files) => {
+    const state = getWorkerState();
+    const coverage = await takeCoverageInsideWorker(config.coverage, executor);
+    if (coverage) {
+      rpc().onAfterSuiteRun({
+        coverage,
+        testFiles: files.map((file) => file.name).sort(),
+        transformMode: state.environment.transformMode,
+        projectName: state.ctx.projectName
+      });
+    }
+    await originalOnAfterRun?.call(testRunner, files);
+  };
+  const originalOnAfterRunTask = testRunner.onAfterRunTask;
+  testRunner.onAfterRunTask = async (test) => {
+    if (config.bail && test.result?.state === "fail") {
+      const previousFailures = await rpc().getCountOfFailedTests();
+      const currentFailures = 1 + previousFailures;
+      if (currentFailures >= config.bail) {
+        rpc().onCancel("test-failure");
+        testRunner.onCancel?.("test-failure");
+      }
+    }
+    await originalOnAfterRunTask?.call(testRunner, test);
+  };
+  return testRunner;
+}
+
+export { resolveSnapshotEnvironment as a, resolveTestRunner as r, setupChaiConfig as s };