feat(WP-0010): IHF Phase 9 — External API Surface and Consumer SDKs

Delivers the full Phase 9 external API layer:

- Versioned REST API (/api/v2/) with OpenAPI 3.1 spec; enum arrays for
  widget_type, event_type, annotation category drawn live from registry tables
- OAuth 2.0 client credentials flow (/api/v2/token); hub:*:write scopes
  gated on active HubCapabilityManifest FK
- API key management: SHA256-hashed tokens, key_prefix for display,
  one-time reveal on creation, revocation support
- TypeScript and Python consumer SDKs generated from registry tables
  (/api/v2/sdk/ihf-client.ts, /api/v2/sdk/ihf-client.py)
- Webhook delivery: HMAC-SHA256 signing, append-only webhook_deliveries,
  fire-and-forget dispatch via forkIO, 3-retry logic
- Admin API dashboard with 24h stats (request count, error rate, last seen)
- Rate limiting (per-minute) and daily quota enforcement via api_request_log
- Schema migration: api_consumers, api_keys, webhook_subscriptions (CHECK
  constraint on 6 framework lifecycle topics), webhook_deliveries
  (append-only trigger), api_request_log
- ARCHITECTURE-LAYERS.md scorecard: 3.34 → 3.41 (approaching Strong)
- contracts/functional/interaction-reporting-v1.md extended with Phase 9
  endpoint catalogue and 422 validation error format

GAAF: no bare TEXT discriminators; webhook event_type uses CHECK constraint
over 6 allowed framework lifecycle topic strings (not widget event types).

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

Web/Controller/Api/V2/DecisionRecords.hs

@@ -0,0 +1,40 @@
+module Web.Controller.Api.V2.DecisionRecords where
+
+import Web.Types
+import Generated.Types
+import IHP.Prelude
+import IHP.ControllerPrelude
+import Data.Aeson (object, (.=))
+import Web.Controller.Api.V2.Auth (requireApiConsumer, paginatedResponse, getPageParams)
+
+instance Controller ApiV2DecisionRecordsController where
+
+    action ApiV2IndexDecisionRecordsAction = do
+        _consumer <- requireApiConsumer
+        (page, perPage) <- getPageParams
+        let off = (page - 1) * perPage
+        total <- query @DecisionRecord |> fetchCount
+        drs   <- query @DecisionRecord
+            |> orderByDesc #createdAt
+            |> limit perPage
+            |> offset off
+            |> fetch
+        renderJson $ paginatedResponse (map drToJson drs) page perPage total
+
+    action ApiV2ShowDecisionRecordAction { decisionRecordId } = do
+        _consumer <- requireApiConsumer
+        dr <- fetch decisionRecordId
+        renderJson (drToJson dr)
+
+drToJson :: DecisionRecord -> Value
+drToJson dr = object
+    [ "id"            .= dr.id
+    , "title"         .= dr.title
+    , "rationale"     .= dr.rationale
+    , "outcome"       .= dr.outcome
+    , "requirementId" .= dr.requirementId
+    , "candidateId"   .= dr.candidateId
+    , "decidedAt"     .= dr.decidedAt
+    , "notes"         .= dr.notes
+    , "createdAt"     .= dr.createdAt
+    ]