feat: Phase 1 — extract the client (web SPA + desktop) to dtoro/oikos-web

Problem: the hexagonal refactor churns the backend tree for nine more
phases; the UI delivery stack (web/ SPA, cmd/desktop Wails wrapper,
compose/web image) must move to its own repo first so doc/layout
rewrites land once on a backend-only tree.

Change:
- New repo git.hubris.network/dtoro/oikos-web (v0.33.0): web/, desktop/
  (updateURL repointed to oikos-web releases), compose/, own CI (web +
  desktop jobs), own deploy script (CI-green gate, TOCTOU guard,
  version-tagged images, prune-to-3), own webhook receiver on :9798 +
  launchd unit, own compose project publishing the same 8091:80.
- Cutover executed on mac-mini in order: oikos stack's web service
  stopped+removed, oikos-web project brought up on 8091; outer Caddy
  untouched (targets the published port) — serving + Authentik flow +
  /wails 404 quirk verified post-cutover.
- Stripped from oikos: web/, cmd/desktop/, compose/web/, desktop CI
  workflow, ci.yml web job, Makefile ui/desktop/desktop-package/install
  targets, the compose web service, oikos-web from deploy.sh's fallback
  prune list; wails + go-keyring dropped from go.mod, vendor synced.
- README / CONTRIBUTING / AGENTS.md / .agents dev+operations docs now
  point at the new repo; mbse + mascot design docs carry a path note.

Risk: production SPA serving depends on the new pipeline now; rollback
is versioned-image re-up of the old web service from a pre-split
checkout (port 8091). Desktop builds installed before the split still
check dtoro/oikos releases — one manual reinstall, noted in the
oikos-web release notes.

Verification: go vet, make test (race), make generate-check, golangci
(no new findings; baseline down 400→365); post-cutover curls —
localhost:8091 200, /wails/runtime.js 404, outer Caddy 302 Authentik.

web/node_modules/why-is-node-running/.github/FUNDING.yml

@@ -0,0 +1 @@
+github: mafintosh

web/node_modules/why-is-node-running/LICENSE

@@ -0,0 +1,21 @@
+The MIT License (MIT)
+
+Copyright (c) 2016 Mathias Buus
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in
+all copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
+THE SOFTWARE.

web/node_modules/why-is-node-running/README.md

@@ -0,0 +1,104 @@
+# why-is-node-running
+
+Node is running but you don't know why? `why-is-node-running` is here to help you.
+
+## Installation
+
+Node 8 and above:
+
+```bash
+npm i why-is-node-running -g
+```
+
+Earlier Node versions (no longer supported):
+
+```bash
+npm i why-is-node-running@v1.x -g
+```
+
+## Usage
+
+```js
+const log = require('why-is-node-running') // should be your first require
+const net = require('net')
+
+function createServer () {
+  const server = net.createServer()
+  setInterval(function () {}, 1000)
+  server.listen(0)
+}
+
+createServer()
+createServer()
+
+setTimeout(function () {
+  log() // logs out active handles that are keeping node running
+}, 100)
+```
+
+Save the file as `example.js`, then execute:
+
+```bash
+node ./example.js
+```
+
+Here's the output:
+
+```
+There are 5 handle(s) keeping the process running
+
+# Timeout
+/home/maf/dev/node_modules/why-is-node-running/example.js:6  - setInterval(function () {}, 1000)
+/home/maf/dev/node_modules/why-is-node-running/example.js:10 - createServer()
+
+# TCPSERVERWRAP
+/home/maf/dev/node_modules/why-is-node-running/example.js:7  - server.listen(0)
+/home/maf/dev/node_modules/why-is-node-running/example.js:10 - createServer()
+
+# Timeout
+/home/maf/dev/node_modules/why-is-node-running/example.js:6  - setInterval(function () {}, 1000)
+/home/maf/dev/node_modules/why-is-node-running/example.js:11 - createServer()
+
+# TCPSERVERWRAP
+/home/maf/dev/node_modules/why-is-node-running/example.js:7  - server.listen(0)
+/home/maf/dev/node_modules/why-is-node-running/example.js:11 - createServer()
+
+# Timeout
+/home/maf/dev/node_modules/why-is-node-running/example.js:13 - setTimeout(function () {
+```
+
+**Important Note!**
+`unref`ed timers do not prevent the Node process from exiting. If you are running with Node v11.0.0 and above, `unref`ed timers will not be listed in the above list. Unfortunately, this is not supported in node versions below v11.0.0.
+
+## CLI
+
+You can also run `why-is-node-running` as a standalone if you don't want to include it inside your code. Sending `SIGUSR1`/`SIGINFO` signal to the process will produce the log. (`Ctrl + T` on macOS and BSD systems)
+
+```bash
+why-is-node-running /path/to/some/file.js
+```
+
+```
+probing module /path/to/some/file.js
+kill -SIGUSR1 31115 for logging
+```
+
+To trigger the log:
+
+```
+kill -SIGUSR1 31115
+```
+
+## Require CLI Option
+
+You can also use the node `-r` option to include `why-is-node-running`:
+
+```bash
+node -r why-is-node-running/include /path/to/some/file.js
+```
+
+The steps are otherwise the same as the above CLI section
+
+## License
+
+MIT

web/node_modules/why-is-node-running/cli.js

@@ -0,0 +1,18 @@
+#!/usr/bin/env node
+
+var spawn = require('child_process').spawn
+var path = require('path')
+
+var prog = path.resolve(process.argv[2])
+var progArgs = process.argv.slice(3)
+
+console.log('probing program', prog)
+
+var nodeArgs = [
+  '-r',
+  path.join(__dirname, 'include.js')
+]
+var nodeOpts = { stdio: 'inherit' }
+var child = spawn('node', nodeArgs.concat(prog).concat(progArgs), nodeOpts)
+
+console.log('kill -SIGUSR1', child.pid, 'for logging')

web/node_modules/why-is-node-running/example.js

@@ -0,0 +1,15 @@
+var log = require('./')
+var net = require('net')
+
+function createServer () {
+  var server = net.createServer()
+  setInterval(function () {}, 1000)
+  server.listen(0)
+}
+
+createServer()
+createServer()
+
+setTimeout(function () {
+  log()
+}, 100)

web/node_modules/why-is-node-running/include.js

@@ -0,0 +1,3 @@
+var why = require('./')
+
+require('siginfo')(why, true)

web/node_modules/why-is-node-running/index.js

@@ -0,0 +1,67 @@
+var asyncHooks = require('async_hooks')
+var stackback = require('stackback')
+var path = require('path')
+var fs = require('fs')
+var sep = path.sep
+
+var active = new Map()
+var hook = asyncHooks.createHook({
+  init (asyncId, type, triggerAsyncId, resource) {
+    if (type === 'TIMERWRAP' || type === 'PROMISE') return
+    if (type === 'PerformanceObserver' || type === 'RANDOMBYTESREQUEST') return
+    var err = new Error('whatevs')
+    var stacks = stackback(err)
+    active.set(asyncId, {type, stacks, resource})
+  },
+  destroy (asyncId) {
+    active.delete(asyncId)
+  }
+})
+
+hook.enable()
+module.exports = whyIsNodeRunning
+
+function whyIsNodeRunning (logger) {
+  if (!logger) logger = console
+
+  hook.disable()
+  var activeResources = [...active.values()].filter(function(r) {
+    if (
+      typeof r.resource.hasRef === 'function'
+      && !r.resource.hasRef()
+    ) return false
+    return true
+  })
+
+  logger.error('There are %d handle(s) keeping the process running', activeResources.length)
+  for (const o of activeResources) printStacks(o)
+
+  function printStacks (o) {
+    var stacks = o.stacks.slice(1).filter(function (s) {
+      var filename = s.getFileName()
+      return filename && filename.indexOf(sep) > -1 && filename.indexOf('internal' + sep) !== 0 && filename.indexOf('node:internal' + sep) !== 0
+    })
+
+    logger.error('')
+    logger.error('# %s', o.type)
+
+    if (!stacks[0]) {
+      logger.error('(unknown stack trace)')
+    } else {
+      var padding = ''
+      stacks.forEach(function (s) {
+        var pad = (s.getFileName() + ':' + s.getLineNumber()).replace(/./g, ' ')
+        if (pad.length > padding.length) padding = pad
+      })
+      stacks.forEach(function (s) {
+        var prefix = s.getFileName() + ':' + s.getLineNumber()
+        try {
+          var src = fs.readFileSync(s.getFileName(), 'utf-8').split(/\n|\r\n/)
+          logger.error(prefix + padding.slice(prefix.length) + ' - ' + src[s.getLineNumber() - 1].trim())
+        } catch (e) {
+          logger.error(prefix + padding.slice(prefix.length))
+        }
+      })
+    }
+  }
+}

web/node_modules/why-is-node-running/package.json

@@ -0,0 +1,39 @@
+{
+  "name": "why-is-node-running",
+  "version": "2.3.0",
+  "description": "Node is running but you don't know why? why-is-node-running is here to help you.",
+  "main": "index.js",
+  "dependencies": {
+    "siginfo": "^2.0.0",
+    "stackback": "0.0.2"
+  },
+  "bin": {
+    "why-is-node-running": "cli.js"
+  },
+  "engines": {
+    "node": ">=8"
+  },
+  "repository": {
+    "type": "git",
+    "url": "https://github.com/mafintosh/why-is-node-running.git"
+  },
+  "keywords": [
+    "debug",
+    "devops",
+    "test",
+    "events",
+    "handles"
+  ],
+  "author": "Mathias Buus (@mafintosh)",
+  "contributors": [
+    {
+      "name": "Jon Peck",
+      "email": "jpeck@fluxsauce.com"
+    }
+  ],
+  "license": "MIT",
+  "bugs": {
+    "url": "https://github.com/mafintosh/why-is-node-running/issues"
+  },
+  "homepage": "https://github.com/mafintosh/why-is-node-running"
+}