feat(WP-0010): IHF Phase 9 — External API Surface and Consumer SDKs

Delivers the full Phase 9 external API layer:

- Versioned REST API (/api/v2/) with OpenAPI 3.1 spec; enum arrays for
  widget_type, event_type, annotation category drawn live from registry tables
- OAuth 2.0 client credentials flow (/api/v2/token); hub:*:write scopes
  gated on active HubCapabilityManifest FK
- API key management: SHA256-hashed tokens, key_prefix for display,
  one-time reveal on creation, revocation support
- TypeScript and Python consumer SDKs generated from registry tables
  (/api/v2/sdk/ihf-client.ts, /api/v2/sdk/ihf-client.py)
- Webhook delivery: HMAC-SHA256 signing, append-only webhook_deliveries,
  fire-and-forget dispatch via forkIO, 3-retry logic
- Admin API dashboard with 24h stats (request count, error rate, last seen)
- Rate limiting (per-minute) and daily quota enforcement via api_request_log
- Schema migration: api_consumers, api_keys, webhook_subscriptions (CHECK
  constraint on 6 framework lifecycle topics), webhook_deliveries
  (append-only trigger), api_request_log
- ARCHITECTURE-LAYERS.md scorecard: 3.34 → 3.41 (approaching Strong)
- contracts/functional/interaction-reporting-v1.md extended with Phase 9
  endpoint catalogue and 422 validation error format

GAAF: no bare TEXT discriminators; webhook event_type uses CHECK constraint
over 6 allowed framework lifecycle topic strings (not widget event types).

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

Web/Controller/RequirementCandidates.hs

@@ -14,6 +14,9 @@ import Data.Aeson (decode, Value(..), Array)
 import Data.Aeson.Lens (key, _String)
 import Control.Lens ((^?))
 import Data.ByteString.Lazy (fromStrict)
+import Web.Job.WebhookDeliveryJob (dispatchWebhooks)
+import Control.Concurrent (forkIO)
+import Data.Aeson ((.=), object)
 import Data.Text.Encoding (encodeUtf8)
 import Data.HashMap.Strict (HashMap)
 import qualified Data.HashMap.Strict as HashMap
@@ -95,6 +98,15 @@ instance Controller RequirementCandidatesController where
                 Left candidate -> render NewView { candidate, widgets, threads }
                 Right candidate -> do
                     created <- createRecord candidate
+                    -- Dispatch webhooks fire-and-forget
+                    let webhookPayload = object
+                            [ "event"      .= ("requirement_candidate.created" :: Text)
+                            , "resourceId" .= created.id
+                            , "title"      .= created.title
+                            , "category"   .= created.category
+                            ]
+                    liftIO $ void $ forkIO $
+                        dispatchWebhooks "requirement_candidate.created" webhookPayload
                     setSuccessMessage "Requirement candidate created"
                     redirectTo ShowRequirementCandidateAction { requirementCandidateId = created.id }