feat(WP-0010): IHF Phase 9 — External API Surface and Consumer SDKs

Delivers the full Phase 9 external API layer:

- Versioned REST API (/api/v2/) with OpenAPI 3.1 spec; enum arrays for
  widget_type, event_type, annotation category drawn live from registry tables
- OAuth 2.0 client credentials flow (/api/v2/token); hub:*:write scopes
  gated on active HubCapabilityManifest FK
- API key management: SHA256-hashed tokens, key_prefix for display,
  one-time reveal on creation, revocation support
- TypeScript and Python consumer SDKs generated from registry tables
  (/api/v2/sdk/ihf-client.ts, /api/v2/sdk/ihf-client.py)
- Webhook delivery: HMAC-SHA256 signing, append-only webhook_deliveries,
  fire-and-forget dispatch via forkIO, 3-retry logic
- Admin API dashboard with 24h stats (request count, error rate, last seen)
- Rate limiting (per-minute) and daily quota enforcement via api_request_log
- Schema migration: api_consumers, api_keys, webhook_subscriptions (CHECK
  constraint on 6 framework lifecycle topics), webhook_deliveries
  (append-only trigger), api_request_log
- ARCHITECTURE-LAYERS.md scorecard: 3.34 → 3.41 (approaching Strong)
- contracts/functional/interaction-reporting-v1.md extended with Phase 9
  endpoint catalogue and 422 validation error format

GAAF: no bare TEXT discriminators; webhook event_type uses CHECK constraint
over 6 allowed framework lifecycle topic strings (not widget event types).

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

CLAUDE.md

@@ -108,17 +108,11 @@ Key rules:
 
 ## Active Workplan
 
-Phase 9 (External API) work is tracked in `workplans/IHUB-WP-0010-ihf-phase9-external-api.md`. Use `/ralph-workplan workplans/IHUB-WP-0010-ihf-phase9-external-api.md` to drive implementation loops.
+Phase 10 (Hub Registry and Widget Marketplace) is the next target. Create workplan `workplans/IHUB-WP-0011-ihf-phase10-hub-registry.md` when ready. Use `/ralph-workplan` to drive implementation.
 
-Phase 9 entry gates (all satisfied by IHUB-WP-0009):
-- Four type registries seeded and validated in controllers ✓
-- `HubCapabilityManifest` table and activation workflow operational ✓
-- `/contracts/` directory with Core and Functional contract artifacts ✓
-- `ARCHITECTURE-LAYERS.md` scorecard at ≥3.3 ✓ (actual: 3.34)
-- Architectural fitness functions in CI ✓
-- `docs/domain-hub-extension-guide.md` published ✓
+Phase 10 builds directly on `HubCapabilityManifest` (from WP-0009) — the hub registry IS that table with a public-facing discovery UI. No new hub registry table is required.
 
-Completed workplans: IHUB-WP-0001 (Phase 1), IHUB-WP-0002 (Phase 2), IHUB-WP-0003 (Phase 3), IHUB-WP-0004 (Phase 4), IHUB-WP-0005 (Phase 5), IHUB-WP-0006 (Phase 6), IHUB-WP-0007 (Phase 7), IHUB-WP-0008 (Phase 8), IHUB-WP-0009 (GAAF Compliance Foundation).
+Completed workplans: IHUB-WP-0001 (Phase 1), IHUB-WP-0002 (Phase 2), IHUB-WP-0003 (Phase 3), IHUB-WP-0004 (Phase 4), IHUB-WP-0005 (Phase 5), IHUB-WP-0006 (Phase 6), IHUB-WP-0007 (Phase 7), IHUB-WP-0008 (Phase 8), IHUB-WP-0009 (GAAF Compliance Foundation), IHUB-WP-0010 (Phase 9 — External API Surface and Consumer SDKs).
 
 ## GAAF Architecture Rules (enforced from IHUB-WP-0009)