feat: Phase 1 — extract the client (web SPA + desktop) to dtoro/oikos-web

Problem: the hexagonal refactor churns the backend tree for nine more
phases; the UI delivery stack (web/ SPA, cmd/desktop Wails wrapper,
compose/web image) must move to its own repo first so doc/layout
rewrites land once on a backend-only tree.

Change:
- New repo git.hubris.network/dtoro/oikos-web (v0.33.0): web/, desktop/
  (updateURL repointed to oikos-web releases), compose/, own CI (web +
  desktop jobs), own deploy script (CI-green gate, TOCTOU guard,
  version-tagged images, prune-to-3), own webhook receiver on :9798 +
  launchd unit, own compose project publishing the same 8091:80.
- Cutover executed on mac-mini in order: oikos stack's web service
  stopped+removed, oikos-web project brought up on 8091; outer Caddy
  untouched (targets the published port) — serving + Authentik flow +
  /wails 404 quirk verified post-cutover.
- Stripped from oikos: web/, cmd/desktop/, compose/web/, desktop CI
  workflow, ci.yml web job, Makefile ui/desktop/desktop-package/install
  targets, the compose web service, oikos-web from deploy.sh's fallback
  prune list; wails + go-keyring dropped from go.mod, vendor synced.
- README / CONTRIBUTING / AGENTS.md / .agents dev+operations docs now
  point at the new repo; mbse + mascot design docs carry a path note.

Risk: production SPA serving depends on the new pipeline now; rollback
is versioned-image re-up of the old web service from a pre-split
checkout (port 8091). Desktop builds installed before the split still
check dtoro/oikos releases — one manual reinstall, noted in the
oikos-web release notes.

Verification: go vet, make test (race), make generate-check, golangci
(no new findings; baseline down 400→365); post-cutover curls —
localhost:8091 200, /wails/runtime.js 404, outer Caddy 302 Authentik.

web/node_modules/zimmerframe/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2023 [these people](https://github.com/Rich-Harris/zimmerframe/graphs/contributors)
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

web/node_modules/zimmerframe/README.md

@@ -0,0 +1,180 @@
+# zimmerframe
+
+A tool for walking.
+
+Specifically, it's a tool for walking an abstract syntax tree (AST), where every node is an object with a `type: string`. This includes [ESTree](https://github.com/estree/estree) nodes, such as you might generate with [Acorn](https://github.com/acornjs/acorn) or [Meriyah](https://github.com/meriyah/meriyah), but also includes things like [CSSTree](https://github.com/csstree/csstree) or an arbitrary AST of your own devising.
+
+## Usage
+
+```ts
+import { walk } from 'zimmerframe';
+import { parse } from 'acorn';
+import { Node } from 'estree';
+
+const program = parse(`
+let message = 'hello';
+console.log(message);
+
+if (true) {
+  let answer = 42;
+  console.log(answer);
+}
+`);
+
+// You can pass in arbitrary state
+const state = {
+  declarations: [],
+  depth: 0
+};
+
+const transformed = walk(program as Node, state, {
+  _(node, { state, next }) {
+    // the `_` visitor is 'universal' — if provided,
+    // it will run for every node, before deferring
+    // to specialised visitors. you can pass a new
+    // `state` object to `next`
+    next({ ...state, answer: 42 });
+  },
+  VariableDeclarator(node, { state }) {
+    // `state` is passed into each visitor
+    if (node.id.type === 'Identifier') {
+      state.declarations.push({
+        depth: state.depth,
+        name: node.id.name
+      });
+    }
+  },
+  BlockStatement(node, { state, next, stop }) {
+    // you must call `next()` or `next(childState)`
+    // to visit child nodes
+    console.log('entering BlockStatement');
+    next({ ...state, depth: state.depth + 1 });
+    console.log('leaving BlockStatement');
+  },
+  Literal(node) {
+    // if you return something, it will replace
+    // the current node
+    if (node.value === 'hello') {
+      return {
+        ...node,
+        value: 'goodbye'
+      };
+    }
+  },
+  IfStatement(node, { visit }) {
+    // normally, returning a value will halt
+    // traversal into child nodes. you can
+    // transform children with the current
+    // visitors using `visit(node, state?)`
+    if (node.test.type === 'Literal' && node.test.value === true) {
+      return visit(node.consequent);
+    }
+  }
+});
+```
+
+The `transformed` AST would look like this:
+
+```js
+let message = 'goodbye';
+console.log(message);
+
+{
+  let answer = 42;
+  console.log(answer);
+}
+```
+
+## Types
+
+The type of `node` in each visitor is inferred from the visitor's name. For example:
+
+```ts
+walk(ast as estree.Node, state, {
+  ArrowFunctionExpression(node) {
+    // `node` is of type estree.ArrowFunctionExpression
+  }
+});
+```
+
+For this to work, the first argument should be casted to an union of all the types you plan to visit.
+
+You can import types from 'zimmerframe':
+
+```ts
+import {
+  walk,
+  type Visitor,
+  type Visitors,
+  type Context
+} from 'zimmerframe';
+import type { Node } from 'estree';
+
+interface State {...}
+
+const node: Node = {...};
+const state: State = {...};
+const visitors: Visitors<Node, State> =  {...}
+
+walk(node, state, visitors);
+```
+
+## Context
+
+Each visitor receives a second argument, `context`, which is an object with the following properties and methods:
+
+- `next(state?: State): void` — a function that allows you to control when child nodes are visited, and which state they are visited with. If child visitors transform their inputs, this will return the transformed node (if not, returns `undefined`)
+- `path: Node[]` — an array of parent nodes. For example, to get the root node you would do `path.at(0)`; to get the current node's immediate parent you would do `path.at(-1)`
+- `state: State` — an object of the same type as the second argument to `walk`. Visitors can pass new state objects to their children with `next(childState)` or `visit(node, childState)`
+- `stop(): void` — prevents any subsequent traversal
+- `visit(node: Node, state?: State): Node` — returns the result of visiting `node` with the current set of visitors. If no `state` is provided, children will inherit the current state
+
+## Immutability
+
+ASTs are regarded as immutable. If you return a transformed node from a visitor, then all parents of the node will be replaced with clones, but unchanged subtrees will reuse the existing nodes.
+
+For example in this case, no transformation takes place, meaning that the returned value is identical to the original AST:
+
+```js
+const transformed = walk(original, state, {
+  Literal(node) {
+    console.log(node.value);
+  }
+});
+
+transformed === original; // true
+```
+
+In this case, however, we replace one of the nodes:
+
+```js
+const original = {
+  type: 'BinaryExpression',
+  operator: '+',
+  left: {
+    type: 'Identifier',
+    name: 'foo'
+  },
+  right: {
+    type: 'Identifier',
+    name: 'bar'
+  }
+};
+
+const transformed = walk(original, state, {
+  Identifier(node) {
+    if (node.name === 'bar') {
+      return { ...node, name: 'baz' };
+    }
+  }
+});
+
+transformed === original; // false, the BinaryExpression node is cloned
+transformed.left === original.left; // true, we can safely reuse this node
+```
+
+This makes it very easy to transform parts of your AST without incurring the performance and memory overhead of cloning the entire thing, and without the footgun of mutating it in place.
+
+## License
+
+MIT

web/node_modules/zimmerframe/package.json

@@ -0,0 +1,35 @@
+{
+  "name": "zimmerframe",
+  "description": "A tool for walking ASTs",
+  "version": "1.1.4",
+  "repository": {
+    "type": "git",
+    "url": "https://github.com/sveltejs/zimmerframe"
+  },
+  "type": "module",
+  "exports": {
+    ".": {
+      "types": "./types/index.d.ts",
+      "import": "./src/walk.js"
+    }
+  },
+  "types": "./types/index.d.ts",
+  "files": [
+    "src",
+    "types"
+  ],
+  "devDependencies": {
+    "@changesets/cli": "^2.29.7",
+    "dts-buddy": "^0.6.2",
+    "typescript": "^5.9.2",
+    "vitest": "^3.2.4"
+  },
+  "license": "MIT",
+  "scripts": {
+    "changeset:version": "changeset version",
+    "changeset:publish": "changeset publish",
+    "check": "tsc",
+    "test": "vitest --run",
+    "test:watch": "vitest"
+  }
+}

web/node_modules/zimmerframe/src/index.d.ts

@@ -0,0 +1,2 @@
+export * from './walk.js';
+export * from './types.d.ts';

web/node_modules/zimmerframe/src/types.d.ts

@@ -0,0 +1,21 @@
+type BaseNode = { type: string };
+
+type NodeOf<T extends string, X> = X extends { type: T } ? X : never;
+
+type SpecialisedVisitors<T extends BaseNode, U> = {
+	[K in T['type']]?: Visitor<NodeOf<K, T>, U, T>;
+};
+
+export type Visitor<T, U, V> = (node: T, context: Context<V, U>) => V | void;
+
+export type Visitors<T extends BaseNode, U> = T['type'] extends '_'
+	? never
+	: SpecialisedVisitors<T, U> & { _?: Visitor<T, U, T> };
+
+export interface Context<T, U> {
+	next: (state?: U) => T | void;
+	path: T[];
+	state: U;
+	stop: () => void;
+	visit: (node: T, state?: U) => T;
+}

web/node_modules/zimmerframe/src/walk.js

@@ -0,0 +1,168 @@
+/** @import { Context, Visitor, Visitors } from './types.js' */
+
+/**
+ * @template {{ type: string }} T
+ * @template {Record<string, any> | null} U
+ * @param {T} node
+ * @param {U} state
+ * @param {Visitors<T, U>} visitors
+ */
+export function walk(node, state, visitors) {
+	const universal = visitors._;
+
+	let stopped = false;
+
+	/** @type {Visitor<T, U, T>} _ */
+	function default_visitor(_, { next, state }) {
+		next(state);
+	}
+
+	/**
+	 * @param {T} node
+	 * @param {T[]} path
+	 * @param {U} state
+	 * @returns {T | undefined}
+	 */
+	function visit(node, path, state) {
+		// Don't return the node here or it could lead to false-positive mutation detection
+		if (stopped) return;
+		if (!node.type) return;
+
+		/** @type {T | void} */
+		let result;
+
+		/** @type {Record<string, any>} */
+		const mutations = {};
+
+		/** @type {Context<T, U>} */
+		const context = {
+			path,
+			state,
+			next: (next_state = state) => {
+				path.push(node);
+				for (const key in node) {
+					if (key === 'type') continue;
+
+					const child_node = node[key];
+					if (child_node && typeof child_node === 'object') {
+						if (Array.isArray(child_node)) {
+							/** @type {Record<number, T>} */
+							const array_mutations = {};
+							const len = child_node.length;
+
+							let mutated = false;
+
+							for (let i = 0; i < len; i++) {
+								const node = child_node[i];
+								if (node && typeof node === 'object') {
+									const result = visit(node, path, next_state);
+									if (result) {
+										array_mutations[i] = result;
+										mutated = true;
+									}
+								}
+							}
+
+							if (mutated) {
+								mutations[key] = child_node.map(
+									(node, i) => array_mutations[i] ?? node
+								);
+							}
+						} else {
+							const result = visit(
+								/** @type {T} */ (child_node),
+								path,
+								next_state
+							);
+
+							// @ts-ignore
+							if (result) {
+								mutations[key] = result;
+							}
+						}
+					}
+				}
+				path.pop();
+
+				if (Object.keys(mutations).length > 0) {
+					return apply_mutations(node, mutations);
+				}
+			},
+			stop: () => {
+				stopped = true;
+			},
+			visit: (next_node, next_state = state) => {
+				path.push(node);
+				const result = visit(next_node, path, next_state) ?? next_node;
+				path.pop();
+				return result;
+			}
+		};
+
+		let visitor = /** @type {Visitor<T, U, T>} */ (
+			visitors[/** @type {T['type']} */ (node.type)] ?? default_visitor
+		);
+
+		if (universal) {
+			/** @type {T | void} */
+			let inner_result;
+
+			result = universal(node, {
+				...context,
+				/** @param {U} next_state */
+				next: (next_state = state) => {
+					state = next_state; // make it the default for subsequent specialised visitors
+
+					inner_result = visitor(node, {
+						...context,
+						state: next_state
+					});
+
+					return inner_result;
+				}
+			});
+
+			// @ts-expect-error TypeScript doesn't understand that `context.next(...)` is called immediately
+			if (!result && inner_result) {
+				result = inner_result;
+			}
+		} else {
+			result = visitor(node, context);
+		}
+
+		if (!result) {
+			if (Object.keys(mutations).length > 0) {
+				result = apply_mutations(node, mutations);
+			}
+		}
+
+		if (result) {
+			return result;
+		}
+	}
+
+	return visit(node, [], state) ?? node;
+}
+
+/**
+ * @template {Record<string, any>} T
+ * @param {T} node
+ * @param {Record<string, any>} mutations
+ * @returns {T}
+ */
+function apply_mutations(node, mutations) {
+	/** @type {Record<string, any>} */
+	const obj = {};
+
+	const descriptors = Object.getOwnPropertyDescriptors(node);
+
+	for (const key in descriptors) {
+		Object.defineProperty(obj, key, descriptors[key]);
+	}
+
+	for (const key in mutations) {
+		obj[key] = mutations[key];
+	}
+
+	return /** @type {T} */ (obj);
+}

web/node_modules/zimmerframe/types/index.d.ts

@@ -0,0 +1,30 @@
+declare module 'zimmerframe' {
+	export function walk<T extends {
+		type: string;
+	}, U extends Record<string, any> | null>(node: T, state: U, visitors: Visitors<T, U>): T;
+	type BaseNode = { type: string };
+
+	type NodeOf<T extends string, X> = X extends { type: T } ? X : never;
+
+	type SpecialisedVisitors<T extends BaseNode, U> = {
+		[K in T['type']]?: Visitor<NodeOf<K, T>, U, T>;
+	};
+
+	export type Visitor<T, U, V> = (node: T, context: Context<V, U>) => V | void;
+
+	export type Visitors<T extends BaseNode, U> = T['type'] extends '_'
+		? never
+		: SpecialisedVisitors<T, U> & { _?: Visitor<T, U, T> };
+
+	export interface Context<T, U> {
+		next: (state?: U) => T | void;
+		path: T[];
+		state: U;
+		stop: () => void;
+		visit: (node: T, state?: U) => T;
+	}
+
+	export {};
+}
+
+//# sourceMappingURL=index.d.ts.map

web/node_modules/zimmerframe/types/index.d.ts.map

@@ -0,0 +1,23 @@
+{
+	"version": 3,
+	"file": "index.d.ts",
+	"names": [
+		"walk",
+		"BaseNode",
+		"NodeOf",
+		"SpecialisedVisitors",
+		"Visitor",
+		"Visitors",
+		"Context"
+	],
+	"sources": [
+		"../src/walk.js",
+		"../src/types.d.ts"
+	],
+	"sourcesContent": [
+		null,
+		null
+	],
+	"mappings": ";iBASgBA,IAAIA;;;MCTfC,QAAQA;;MAERC,MAAMA;;MAENC,mBAAmBA;;;;aAIZC,OAAOA;;aAEPC,QAAQA;;;;kBAIHC,OAAOA",
+	"ignoreList": []
+}