feat: Phase 1 — extract the client (web SPA + desktop) to dtoro/oikos-web

Problem: the hexagonal refactor churns the backend tree for nine more
phases; the UI delivery stack (web/ SPA, cmd/desktop Wails wrapper,
compose/web image) must move to its own repo first so doc/layout
rewrites land once on a backend-only tree.

Change:
- New repo git.hubris.network/dtoro/oikos-web (v0.33.0): web/, desktop/
  (updateURL repointed to oikos-web releases), compose/, own CI (web +
  desktop jobs), own deploy script (CI-green gate, TOCTOU guard,
  version-tagged images, prune-to-3), own webhook receiver on :9798 +
  launchd unit, own compose project publishing the same 8091:80.
- Cutover executed on mac-mini in order: oikos stack's web service
  stopped+removed, oikos-web project brought up on 8091; outer Caddy
  untouched (targets the published port) — serving + Authentik flow +
  /wails 404 quirk verified post-cutover.
- Stripped from oikos: web/, cmd/desktop/, compose/web/, desktop CI
  workflow, ci.yml web job, Makefile ui/desktop/desktop-package/install
  targets, the compose web service, oikos-web from deploy.sh's fallback
  prune list; wails + go-keyring dropped from go.mod, vendor synced.
- README / CONTRIBUTING / AGENTS.md / .agents dev+operations docs now
  point at the new repo; mbse + mascot design docs carry a path note.

Risk: production SPA serving depends on the new pipeline now; rollback
is versioned-image re-up of the old web service from a pre-split
checkout (port 8091). Desktop builds installed before the split still
check dtoro/oikos releases — one manual reinstall, noted in the
oikos-web release notes.

Verification: go vet, make test (race), make generate-check, golangci
(no new findings; baseline down 400→365); post-cutover curls —
localhost:8091 200, /wails/runtime.js 404, outer Caddy 302 Authentik.

web/node_modules/vitest/dist/workers/forks.js

@@ -0,0 +1,41 @@
+import v8 from 'node:v8';
+import { r as runBaseTests } from '../chunks/base.BZZh4cSm.js';
+import { c as createForksRpcOptions, u as unwrapSerializableConfig } from '../chunks/utils.Cn0zI1t3.js';
+import 'vite-node/client';
+import '../chunks/execute.2pr0rHgK.js';
+import 'node:fs';
+import 'node:url';
+import 'node:vm';
+import '@vitest/utils/error';
+import 'pathe';
+import 'vite-node/utils';
+import '../path.js';
+import 'node:path';
+import '@vitest/mocker';
+import 'node:module';
+import '@vitest/utils';
+import '../chunks/utils.C8RiOc4B.js';
+
+class ForksBaseWorker {
+  getRpcOptions() {
+    return createForksRpcOptions(v8);
+  }
+  async executeTests(method, state) {
+    const exit = process.exit;
+    state.ctx.config = unwrapSerializableConfig(state.ctx.config);
+    try {
+      await runBaseTests(method, state);
+    } finally {
+      process.exit = exit;
+    }
+  }
+  runTests(state) {
+    return this.executeTests("run", state);
+  }
+  collectTests(state) {
+    return this.executeTests("collect", state);
+  }
+}
+var forks = new ForksBaseWorker();
+
+export { forks as default };

web/node_modules/vitest/dist/workers/runVmTests.js

@@ -0,0 +1,95 @@
+import { createRequire } from 'node:module';
+import { performance } from 'node:perf_hooks';
+import timers from 'node:timers';
+import util from 'node:util';
+import { startTests, collectTests } from '@vitest/runner';
+import { KNOWN_ASSET_TYPES } from 'vite-node/constants';
+import { installSourcemapsSupport } from 'vite-node/source-map';
+import { s as setupChaiConfig, r as resolveTestRunner, a as resolveSnapshotEnvironment } from '../chunks/index.nEwtF0bu.js';
+import { s as startCoverageInsideWorker, a as stopCoverageInsideWorker } from '../chunks/coverage.BoMDb1ip.js';
+import { V as VitestIndex } from '../chunks/index.ckWaX2gY.js';
+import { c as closeInspector } from '../chunks/inspector.70d6emsh.js';
+import { s as setupCommonEnv } from '../chunks/setup-common.Dj6BZI3u.js';
+import { g as getWorkerState } from '../chunks/utils.C8RiOc4B.js';
+import 'chai';
+import 'node:path';
+import '../path.js';
+import 'node:url';
+import '../chunks/rpc.C3q9uwRX.js';
+import '@vitest/utils';
+import '../chunks/index.68735LiX.js';
+import '../chunks/vi.DgezovHB.js';
+import '@vitest/expect';
+import '@vitest/runner/utils';
+import '../chunks/_commonjsHelpers.BFTU3MAI.js';
+import '@vitest/snapshot';
+import '@vitest/utils/error';
+import '@vitest/utils/source-map';
+import '../chunks/date.W2xKR2qe.js';
+import '@vitest/spy';
+import '../chunks/run-once.2ogXb3JV.js';
+import '../chunks/benchmark.Cdu9hjj4.js';
+import 'expect-type';
+
+async function run(method, files, config, executor) {
+  const workerState = getWorkerState();
+  await setupCommonEnv(config);
+  Object.defineProperty(globalThis, "__vitest_index__", {
+    value: VitestIndex,
+    enumerable: false
+  });
+  if (workerState.environment.transformMode === "web") {
+    const _require = createRequire(import.meta.url);
+    _require.extensions[".css"] = resolveCss;
+    _require.extensions[".scss"] = resolveCss;
+    _require.extensions[".sass"] = resolveCss;
+    _require.extensions[".less"] = resolveCss;
+    KNOWN_ASSET_TYPES.forEach((type) => {
+      _require.extensions[`.${type}`] = resolveAsset;
+    });
+    process.env.SSR = "";
+  } else {
+    process.env.SSR = "1";
+  }
+  globalThis.__vitest_required__ = {
+    util,
+    timers
+  };
+  installSourcemapsSupport({
+    getSourceMap: (source) => workerState.moduleCache.getSourceMap(source)
+  });
+  await startCoverageInsideWorker(config.coverage, executor);
+  if (config.chaiConfig) {
+    setupChaiConfig(config.chaiConfig);
+  }
+  const [runner, snapshotEnvironment] = await Promise.all([
+    resolveTestRunner(config, executor),
+    resolveSnapshotEnvironment(config, executor)
+  ]);
+  config.snapshotOptions.snapshotEnvironment = snapshotEnvironment;
+  workerState.onCancel.then((reason) => {
+    closeInspector(config);
+    runner.onCancel?.(reason);
+  });
+  workerState.durations.prepare = performance.now() - workerState.durations.prepare;
+  const { vi } = VitestIndex;
+  for (const file of files) {
+    workerState.filepath = file;
+    if (method === "run") {
+      await startTests([file], runner);
+    } else {
+      await collectTests([file], runner);
+    }
+    vi.resetConfig();
+    vi.restoreAllMocks();
+  }
+  await stopCoverageInsideWorker(config.coverage, executor);
+}
+function resolveCss(mod) {
+  mod.exports = "";
+}
+function resolveAsset(mod, url) {
+  mod.exports = url;
+}
+
+export { run };

web/node_modules/vitest/dist/workers/threads.js

@@ -0,0 +1,31 @@
+import { r as runBaseTests } from '../chunks/base.BZZh4cSm.js';
+import { a as createThreadsRpcOptions } from '../chunks/utils.Cn0zI1t3.js';
+import 'vite-node/client';
+import '../chunks/execute.2pr0rHgK.js';
+import 'node:fs';
+import 'node:url';
+import 'node:vm';
+import '@vitest/utils/error';
+import 'pathe';
+import 'vite-node/utils';
+import '../path.js';
+import 'node:path';
+import '@vitest/mocker';
+import 'node:module';
+import '@vitest/utils';
+import '../chunks/utils.C8RiOc4B.js';
+
+class ThreadsBaseWorker {
+  getRpcOptions(ctx) {
+    return createThreadsRpcOptions(ctx);
+  }
+  runTests(state) {
+    return runBaseTests("run", state);
+  }
+  collectTests(state) {
+    return runBaseTests("collect", state);
+  }
+}
+var threads = new ThreadsBaseWorker();
+
+export { threads as default };

web/node_modules/vitest/dist/workers/vmForks.js

@@ -0,0 +1,47 @@
+import v8 from 'node:v8';
+import { c as createForksRpcOptions, u as unwrapSerializableConfig } from '../chunks/utils.Cn0zI1t3.js';
+import { r as runVmTests } from '../chunks/vm.Zr4qWzDJ.js';
+import '@vitest/utils';
+import 'node:url';
+import 'node:vm';
+import 'pathe';
+import '../path.js';
+import 'node:path';
+import '../chunks/console.BYGVloWk.js';
+import 'node:console';
+import 'node:stream';
+import 'tinyrainbow';
+import '../chunks/date.W2xKR2qe.js';
+import '../chunks/utils.C8RiOc4B.js';
+import '../chunks/execute.2pr0rHgK.js';
+import 'node:fs';
+import '@vitest/utils/error';
+import 'vite-node/client';
+import 'vite-node/utils';
+import '@vitest/mocker';
+import 'node:module';
+import 'vite-node/constants';
+
+class ForksVmWorker {
+  getRpcOptions() {
+    return createForksRpcOptions(v8);
+  }
+  async executeTests(method, state) {
+    const exit = process.exit;
+    state.ctx.config = unwrapSerializableConfig(state.ctx.config);
+    try {
+      await runVmTests(method, state);
+    } finally {
+      process.exit = exit;
+    }
+  }
+  runTests(state) {
+    return this.executeTests("run", state);
+  }
+  collectTests(state) {
+    return this.executeTests("collect", state);
+  }
+}
+var vmForks = new ForksVmWorker();
+
+export { vmForks as default };

web/node_modules/vitest/dist/workers/vmThreads.js

@@ -0,0 +1,37 @@
+import { a as createThreadsRpcOptions } from '../chunks/utils.Cn0zI1t3.js';
+import { r as runVmTests } from '../chunks/vm.Zr4qWzDJ.js';
+import '@vitest/utils';
+import 'node:url';
+import 'node:vm';
+import 'pathe';
+import '../path.js';
+import 'node:path';
+import '../chunks/console.BYGVloWk.js';
+import 'node:console';
+import 'node:stream';
+import 'tinyrainbow';
+import '../chunks/date.W2xKR2qe.js';
+import '../chunks/utils.C8RiOc4B.js';
+import '../chunks/execute.2pr0rHgK.js';
+import 'node:fs';
+import '@vitest/utils/error';
+import 'vite-node/client';
+import 'vite-node/utils';
+import '@vitest/mocker';
+import 'node:module';
+import 'vite-node/constants';
+
+class ThreadsVmWorker {
+  getRpcOptions(ctx) {
+    return createThreadsRpcOptions(ctx);
+  }
+  runTests(state) {
+    return runVmTests("run", state);
+  }
+  collectTests(state) {
+    return runVmTests("collect", state);
+  }
+}
+var vmThreads = new ThreadsVmWorker();
+
+export { vmThreads as default };