feat(deploy): containerize the web UI as its own compose service

The SPA-from-binary split (0c0f35a) left `make deploy-ui` pointing at a
deploy path that was never actually wired up: scp to a "mac-mini" SSH
host that doesn't resolve from itself, a /var/www/oikos-ui/ that doesn't
exist, and `systemctl reload caddy` on a box with no Caddy installed at
all (not brew, not a container, nothing on 80/443).

Add a `web` service (compose/web/Dockerfile: node build -> caddy:2-alpine
static + SPA-fallback serving) to docker-compose.yml so the UI deploys
through the same push-to-main -> webhook -> docker compose build/up
pipeline the rest of the stack already uses, instead of a manual
scp/ssh step. Drop the broken `deploy-ui` Makefile target; `make ui`
stays as a local build sanity-check.

Update the reference Caddy config (compose/caddy/Caddyfile.oikos) to
reverse_proxy the new :8091 service instead of reading static files off
local disk, and fill in the <mac-mini-mesh-ip> placeholders with the
actual LAN IP (192.168.178.182 — the LXC and mac-mini subnets are
routed). This file is a reference only; the real caddy-conf repo change
is applied separately after review.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

Makefile

@@ -1,4 +1,4 @@
-.PHONY: build webhook test test-db lint generate generate-check dev migrate seed export clean tidy ui deploy-ui
+.PHONY: build webhook test test-db lint generate generate-check dev migrate seed export clean tidy ui
 
 BINARY := oikos
 GO ?= go
@@ -45,15 +45,13 @@ export:
 dev:
 	docker compose --profile dev up -d
 
-# The SPA is a standalone static build, no longer embedded in the oikos
-# binary (plans/2026-07-12-wails-desktop-app.md 0.1) — deployed separately.
+# Local sanity-check build of the SPA. Not embedded in the oikos binary
+# (plans/2026-07-12-wails-desktop-app.md 0.1) — deploys as its own
+# container (compose/web/Dockerfile) via `docker compose --profile full
+# up -d web`, same push-to-main pipeline as everything else.
 ui:
 	cd web && npm run build
 
-deploy-ui: ui
-	scp -r web/dist/* mac-mini:/var/www/oikos-ui/
-	ssh mac-mini sudo systemctl reload caddy
-
 clean:
 	rm -f $(BINARY)
 	$(GO) clean -testcache