feat(P5): IHF Phase 5 complete — agent-assisted distillation

Adds bounded AI support to the IHF governance loop. All AI outputs are
attributed (model_ref), reviewable (AgentReviewRecord), and reversible.
No autonomous decisions; no silent requirement promotion.

- T01: Schema — agent_proposals, agent_review_records,
  confidence_annotations (migration 1743379200)
- T02: AgentProposalsController (index/show/accept/reject, idempotent
  review guard), global nav "Agent" link
- T03: SummarizeClusterAction — Claude API cluster summary on widget show
- T04: DraftRequirementAction — AI requirement draft; acceptance creates
  RequirementCandidate (human-gated)
- T05: DetectDuplicatesAction — duplicate_flag proposal on candidate show
- T06: DetectPolicySensitivityAction — policy_flag with
  ConfidenceAnnotations per concern scope
- T07: ProposeImplementationAction — impl_proposal from decision show
- T08: AgentAuditDashboardAction — autoRefresh; KPI row, unreviewed queue,
  recent proposals, attribution log matrix
- T09: integration tests, SCOPE.md updated, phase5-summary.md, flake.nix
  adds http-conduit/aeson/string-conversions

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

Application/Helper/Controller.hs

@@ -5,6 +5,14 @@ import Generated.Types
 import Data.Time.Clock (addUTCTime)
 import Data.List (sortBy)
 
+-- Phase 5: Anthropic API
+import Network.HTTP.Conduit (newManager, tlsManagerSettings, parseRequest, httpLbs, responseBody, method, requestHeaders, requestBody, RequestBodyLBS(..))
+import Data.Aeson (object, (.=), encode, eitherDecode, Value)
+import Data.Aeson.Lens (key, _String, nth)
+import Control.Lens ((^?))
+import Data.String.Conversions (cs)
+import System.Environment (lookupEnv)
+
 -- Here you can add functions which are available in all your controllers
 
 -- | Returns the set of widget IDs that are currently in regression.
@@ -68,4 +76,53 @@ widgetCycleCounts candidates requirements decisions deployments =
             [ ()
             | deplTime <- deplTimes
             , any (\c -> c.createdAt > deplTime) widCandidates
-            ]
+            ]
+
+-- | Call the Anthropic Messages API.
+--
+-- Returns the text content of the first content block, or an error message.
+-- API key read from IHP_ANTHROPIC_API_KEY env var.
+-- On any error (missing key, HTTP failure, unexpected JSON) returns Left with a description.
+callClaudeApi
+    :: Text   -- ^ system prompt
+    -> Text   -- ^ user message
+    -> Int    -- ^ max_tokens
+    -> IO (Either Text Text)
+callClaudeApi systemPrompt userMessage maxTokens = do
+    mApiKey <- lookupEnv "IHP_ANTHROPIC_API_KEY"
+    case mApiKey of
+        Nothing -> pure (Left "IHP_ANTHROPIC_API_KEY is not set")
+        Just apiKey -> do
+            let url = "https://api.anthropic.com/v1/messages"
+            let body = object
+                    [ "model"      .= ("claude-sonnet-4-6" :: Text)
+                    , "max_tokens" .= maxTokens
+                    , "system"     .= systemPrompt
+                    , "messages"   .= [ object
+                            [ "role"    .= ("user" :: Text)
+                            , "content" .= userMessage
+                            ] ]
+                    ]
+            let reqBody = RequestBodyLBS (encode body)
+            manager  <- newManager tlsManagerSettings
+            initReq  <- parseRequest url
+            let req = initReq
+                    { method      = "POST"
+                    , requestHeaders =
+                        [ ("content-type",      "application/json")
+                        , ("x-api-key",         cs apiKey)
+                        , ("anthropic-version", "2023-06-01")
+                        ]
+                    , requestBody = reqBody
+                    }
+            resp <- httpLbs req manager
+            let respBody = responseBody resp
+            case eitherDecode respBody of
+                Left err  -> pure (Left ("JSON parse error: " <> cs err))
+                Right val ->
+                    case val ^? key "content" . nth 0 . key "text" . _String of
+                        Just txt -> pure (Right txt)
+                        Nothing  ->
+                            case val ^? key "error" . key "message" . _String of
+                                Just msg -> pure (Left ("API error: " <> msg))
+                                Nothing  -> pure (Left "Unexpected API response shape")