feat(deploy): containerize the web UI as its own compose service

The SPA-from-binary split (0c0f35a) left `make deploy-ui` pointing at a
deploy path that was never actually wired up: scp to a "mac-mini" SSH
host that doesn't resolve from itself, a /var/www/oikos-ui/ that doesn't
exist, and `systemctl reload caddy` on a box with no Caddy installed at
all (not brew, not a container, nothing on 80/443).

Add a `web` service (compose/web/Dockerfile: node build -> caddy:2-alpine
static + SPA-fallback serving) to docker-compose.yml so the UI deploys
through the same push-to-main -> webhook -> docker compose build/up
pipeline the rest of the stack already uses, instead of a manual
scp/ssh step. Drop the broken `deploy-ui` Makefile target; `make ui`
stays as a local build sanity-check.

Update the reference Caddy config (compose/caddy/Caddyfile.oikos) to
reverse_proxy the new :8091 service instead of reading static files off
local disk, and fill in the <mac-mini-mesh-ip> placeholders with the
actual LAN IP (192.168.178.182 — the LXC and mac-mini subnets are
routed). This file is a reference only; the real caddy-conf repo change
is applied separately after review.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

compose/caddy/Caddyfile.oikos

@@ -3,13 +3,19 @@
 # Lives in dtoro/caddy-conf repo; auto-deploys to caddy (LXC 121). THIS COPY
 # IS A REFERENCE, NOT DEPLOYED FROM HERE — keep it in sync manually.
 #
-# The SPA is no longer embedded in the oikos binary; it's served here as
-# static files (`make deploy-ui`). Every API/MCP/agent route now requires a
-# bearer token in all cases (api's dev-open bypass was removed) — non-browser
-# clients (Wails, curl, a future mobile client) can't complete Authentik's
-# browser-session login, so those routes bypass `import authentik` the same
-# way the enrollment endpoint always has and rely on api's own combinedAuth
-# instead. See the Wails plan's "Plan review" section, gap 1.
+# The SPA is no longer embedded in the oikos binary; it's built and served
+# by its own container (compose/web/Dockerfile, docker-compose.yml's `web`
+# service, mac-mini:8091) rather than as static files read off local disk —
+# see that service's comment for why. Every API/MCP/agent route now requires
+# a bearer token in all cases (api's dev-open bypass was removed) —
+# non-browser clients (Wails, curl, a future mobile client) can't complete
+# Authentik's browser-session login, so those routes bypass `import
+# authentik` the same way the enrollment endpoint always has and rely on
+# api's own combinedAuth instead. See the Wails plan's "Plan review"
+# section, gap 1.
+#
+# mac-mini and the LXC subnet are routed, so these target its direct LAN IP
+# rather than the mesh (netbird) hostname.
 
 oikos.hubris.network {
     tls {
@@ -17,7 +23,7 @@ oikos.hubris.network {
     }
     @enroll path /api/v1/clients/enroll
     handle @enroll {
-        reverse_proxy <mac-mini-mesh-ip>:8090
+        reverse_proxy 192.168.178.182:8090
     }
     # Bearer-token clients — api's combinedAuth (internal/httpapi/server.go)
     # is the real gate for all three; Authentik would just reject non-browser
@@ -26,23 +32,22 @@ oikos.hubris.network {
     # covered by the same check as /api/v1/* and /mcp.
     @api path /api/v1/* /mcp /agent/*
     handle @api {
-        reverse_proxy <mac-mini-mesh-ip>:8090
+        reverse_proxy 192.168.178.182:8090
     }
-    # Everything else: the static SPA shell. No sensitive data lives here —
-    # real enforcement is the bearer-token check above — Authentik is just a
-    # first line of defense against anonymous crawlers finding the bundle.
+    # Everything else: the static SPA shell, served by the `web` container.
+    # No sensitive data lives here — real enforcement is the bearer-token
+    # check above — Authentik is just a first line of defense against
+    # anonymous crawlers finding the bundle.
     handle {
         import authentik
-        root * /var/www/oikos-ui
-        file_server
-        try_files {path} /index.html
+        reverse_proxy 192.168.178.182:8091
     }
 }
 
 # Oikos MCP endpoint (agents) — bearer token required (api's combinedAuth),
 # no separate gate here.
 mcp.hubris.network {
-    reverse_proxy <mac-mini-mesh-ip>:8090
+    reverse_proxy 192.168.178.182:8090
 }
 
 # Nomos's own gateway (workstation access) — still has NO auth of its own
@@ -50,5 +55,5 @@ mcp.hubris.network {
 # can reach this host can talk to nomos directly, bypassing api entirely.
 # Not fixed by the client/server split — tracked separately.
 nomos.hubris.network {
-    reverse_proxy <mac-mini-mesh-ip>:8092
+    reverse_proxy 192.168.178.182:8092
 }

compose/web/Caddyfile

@@ -0,0 +1,5 @@
+:80 {
+	root * /srv
+	file_server
+	try_files {path} /index.html
+}

compose/web/Dockerfile

@@ -0,0 +1,18 @@
+# Dockerfile for the oikos control-room SPA. Built separately from the
+# oikos binary (compose/oikos/Dockerfile) — see docker-compose.yml's `web`
+# service. The outer production Caddy (caddy-conf repo, LXC 121) handles
+# Authentik + splits /api/*, /mcp, /agent/* off to the api service; this
+# container only serves static files with SPA-fallback routing.
+
+FROM node:22-alpine AS builder
+
+WORKDIR /build/web
+COPY web/package.json web/package-lock.json ./
+RUN npm ci
+COPY web/ ./
+RUN npm run build
+
+FROM caddy:2-alpine
+
+COPY --from=builder /build/web/dist /srv
+COPY compose/web/Caddyfile /etc/caddy/Caddyfile