Phase 0 separates the SPA from the oikos binary (delete embed.go, add CORS, make API base URL configurable, add auth interceptor, close dev-open gate). Phase 1 builds a thin Wails v3 desktop wrapper — native window + tray + notifications + auto-start + auto-update. SPA shared between browser and desktop builds.