feat: Phase 1 — extract the client (web SPA + desktop) to dtoro/oikos-web

Problem: the hexagonal refactor churns the backend tree for nine more
phases; the UI delivery stack (web/ SPA, cmd/desktop Wails wrapper,
compose/web image) must move to its own repo first so doc/layout
rewrites land once on a backend-only tree.

Change:
- New repo git.hubris.network/dtoro/oikos-web (v0.33.0): web/, desktop/
  (updateURL repointed to oikos-web releases), compose/, own CI (web +
  desktop jobs), own deploy script (CI-green gate, TOCTOU guard,
  version-tagged images, prune-to-3), own webhook receiver on :9798 +
  launchd unit, own compose project publishing the same 8091:80.
- Cutover executed on mac-mini in order: oikos stack's web service
  stopped+removed, oikos-web project brought up on 8091; outer Caddy
  untouched (targets the published port) — serving + Authentik flow +
  /wails 404 quirk verified post-cutover.
- Stripped from oikos: web/, cmd/desktop/, compose/web/, desktop CI
  workflow, ci.yml web job, Makefile ui/desktop/desktop-package/install
  targets, the compose web service, oikos-web from deploy.sh's fallback
  prune list; wails + go-keyring dropped from go.mod, vendor synced.
- README / CONTRIBUTING / AGENTS.md / .agents dev+operations docs now
  point at the new repo; mbse + mascot design docs carry a path note.

Risk: production SPA serving depends on the new pipeline now; rollback
is versioned-image re-up of the old web service from a pre-split
checkout (port 8091). Desktop builds installed before the split still
check dtoro/oikos releases — one manual reinstall, noted in the
oikos-web release notes.

Verification: go vet, make test (race), make generate-check, golangci
(no new findings; baseline down 400→365); post-cutover curls —
localhost:8091 200, /wails/runtime.js 404, outer Caddy 302 Authentik.

web/node_modules/vitest/dist/execute.d.ts

@@ -0,0 +1,144 @@
+import { ViteNodeRunnerOptions } from 'vite-node';
+import { ViteNodeRunner } from 'vite-node/client';
+import { R as RuntimeRPC, W as WorkerGlobalState } from './chunks/worker.tN5KGIih.js';
+import vm from 'node:vm';
+import * as _vitest_mocker from '@vitest/mocker';
+import { MockedModuleType } from '@vitest/mocker';
+import { P as PendingSuiteMock, b as MockFactory, a as MockOptions } from './chunks/mocker.cRtM890J.js';
+import '@vitest/runner';
+import './chunks/config.Cy0C388Z.js';
+import '@vitest/pretty-format';
+import '@vitest/snapshot';
+import '@vitest/snapshot/environment';
+import './chunks/environment.LoooBwUu.js';
+
+declare class FileMap {
+    private fsCache;
+    private fsBufferCache;
+    readFileAsync(path: string): Promise<string>;
+    readFile(path: string): string;
+    readBuffer(path: string): Buffer;
+}
+
+interface ModuleEvaluateOptions {
+    timeout?: vm.RunningScriptOptions['timeout'] | undefined;
+    breakOnSigint?: vm.RunningScriptOptions['breakOnSigint'] | undefined;
+}
+type ModuleLinker = (specifier: string, referencingModule: VMModule, extra: {
+    assert: object;
+}) => VMModule | Promise<VMModule>;
+type ModuleStatus = 'unlinked' | 'linking' | 'linked' | 'evaluating' | 'evaluated' | 'errored';
+declare class VMModule {
+    dependencySpecifiers: readonly string[];
+    error: any;
+    identifier: string;
+    context: vm.Context;
+    namespace: object;
+    status: ModuleStatus;
+    evaluate(options?: ModuleEvaluateOptions): Promise<void>;
+    link(linker: ModuleLinker): Promise<void>;
+}
+
+interface ExternalModulesExecutorOptions {
+    context: vm.Context;
+    fileMap: FileMap;
+    packageCache: Map<string, any>;
+    transform: RuntimeRPC['transform'];
+    interopDefault?: boolean;
+    viteClientModule: Record<string, unknown>;
+}
+declare class ExternalModulesExecutor {
+    #private;
+    private options;
+    private cjs;
+    private esm;
+    private vite;
+    private context;
+    private fs;
+    private resolvers;
+    constructor(options: ExternalModulesExecutorOptions);
+    import(identifier: string): Promise<object>;
+    require(identifier: string): any;
+    createRequire(identifier: string): NodeRequire;
+    importModuleDynamically: (specifier: string, referencer: VMModule) => Promise<VMModule>;
+    resolveModule: (specifier: string, referencer: string) => Promise<VMModule>;
+    resolve(specifier: string, parent: string): string;
+    private findNearestPackageData;
+    private wrapCoreSynteticModule;
+    private wrapCommonJsSynteticModule;
+    private getModuleInformation;
+    private createModule;
+    private get isNetworkSupported();
+}
+
+interface MockContext {
+    /**
+     * When mocking with a factory, this refers to the module that imported the mock.
+     */
+    callstack: null | string[];
+}
+declare class VitestMocker {
+    executor: VitestExecutor;
+    static pendingIds: PendingSuiteMock[];
+    private spyModule?;
+    private primitives;
+    private filterPublicKeys;
+    private registries;
+    private mockContext;
+    constructor(executor: VitestExecutor);
+    private get root();
+    private get moduleCache();
+    private get moduleDirectories();
+    initializeSpyModule(): Promise<void>;
+    private getMockerRegistry;
+    reset(): void;
+    private deleteCachedItem;
+    private isModuleDirectory;
+    getSuiteFilepath(): string;
+    private createError;
+    private resolvePath;
+    resolveMocks(): Promise<void>;
+    private callFunctionMock;
+    getMockContext(): MockContext;
+    getMockPath(dep: string): string;
+    getDependencyMock(id: string): _vitest_mocker.MockedModule | undefined;
+    normalizePath(path: string): string;
+    resolveMockPath(mockPath: string, external: string | null): string | null;
+    mockObject(object: Record<string | symbol, any>, mockExports?: Record<string | symbol, any>, behavior?: MockedModuleType): Record<string | symbol, any>;
+    unmockPath(path: string): void;
+    mockPath(originalId: string, path: string, external: string | null, mockType: MockedModuleType | undefined, factory: MockFactory | undefined): void;
+    importActual<T>(rawId: string, importer: string, callstack?: string[] | null): Promise<T>;
+    importMock(rawId: string, importee: string): Promise<any>;
+    requestWithMock(url: string, callstack: string[]): Promise<any>;
+    queueMock(id: string, importer: string, factoryOrOptions?: MockFactory | MockOptions): void;
+    queueUnmock(id: string, importer: string): void;
+}
+
+interface ExecuteOptions extends ViteNodeRunnerOptions {
+    moduleDirectories?: string[];
+    state: WorkerGlobalState;
+    context?: vm.Context;
+    externalModulesExecutor?: ExternalModulesExecutor;
+}
+declare class VitestExecutor extends ViteNodeRunner {
+    options: ExecuteOptions;
+    mocker: VitestMocker;
+    externalModules?: ExternalModulesExecutor;
+    private primitives;
+    constructor(options: ExecuteOptions);
+    protected getContextPrimitives(): {
+        Object: typeof Object;
+        Reflect: typeof Reflect;
+        Symbol: typeof Symbol;
+    };
+    get state(): WorkerGlobalState;
+    shouldResolveId(id: string, _importee?: string | undefined): boolean;
+    originalResolveUrl(id: string, importer?: string): Promise<[url: string, fsPath: string]>;
+    resolveUrl(id: string, importer?: string): Promise<[url: string, fsPath: string]>;
+    protected runModule(context: Record<string, any>, transformed: string): Promise<void>;
+    importExternalModule(path: string): Promise<any>;
+    dependencyRequest(id: string, fsPath: string, callstack: string[]): Promise<any>;
+    prepareContext(context: Record<string, any>): Record<string, any>;
+}
+
+export { VitestExecutor };