feat(WP-0010): IHF Phase 9 — External API Surface and Consumer SDKs

Delivers the full Phase 9 external API layer:

- Versioned REST API (/api/v2/) with OpenAPI 3.1 spec; enum arrays for
  widget_type, event_type, annotation category drawn live from registry tables
- OAuth 2.0 client credentials flow (/api/v2/token); hub:*:write scopes
  gated on active HubCapabilityManifest FK
- API key management: SHA256-hashed tokens, key_prefix for display,
  one-time reveal on creation, revocation support
- TypeScript and Python consumer SDKs generated from registry tables
  (/api/v2/sdk/ihf-client.ts, /api/v2/sdk/ihf-client.py)
- Webhook delivery: HMAC-SHA256 signing, append-only webhook_deliveries,
  fire-and-forget dispatch via forkIO, 3-retry logic
- Admin API dashboard with 24h stats (request count, error rate, last seen)
- Rate limiting (per-minute) and daily quota enforcement via api_request_log
- Schema migration: api_consumers, api_keys, webhook_subscriptions (CHECK
  constraint on 6 framework lifecycle topics), webhook_deliveries
  (append-only trigger), api_request_log
- ARCHITECTURE-LAYERS.md scorecard: 3.34 → 3.41 (approaching Strong)
- contracts/functional/interaction-reporting-v1.md extended with Phase 9
  endpoint catalogue and 422 validation error format

GAAF: no bare TEXT discriminators; webhook event_type uses CHECK constraint
over 6 allowed framework lifecycle topic strings (not widget event types).

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

Web/View/WebhookSubscriptions/New.hs

@@ -0,0 +1,52 @@
+module Web.View.WebhookSubscriptions.New where
+
+import Web.Types
+import Generated.Types
+import IHP.Prelude
+import IHP.ViewPrelude
+
+webhookTopics :: [Text]
+webhookTopics =
+    [ "interaction_event.created"
+    , "annotation.created"
+    , "requirement_candidate.created"
+    , "decision_record.created"
+    , "deployment_record.created"
+    , "outcome_signal.created"
+    ]
+
+data NewView = NewView
+    { subscription :: !WebhookSubscription
+    , consumer     :: !ApiConsumer
+    }
+
+instance View NewView where
+    html NewView { .. } = [hsx|
+        <div class="max-w-lg">
+            <h1 class="text-2xl font-semibold mb-2">New Webhook Subscription</h1>
+            <p class="text-sm text-gray-500 mb-6">Consumer: <strong>{consumer.name}</strong></p>
+            <form method="POST" action={CreateWebhookSubscriptionAction} class="space-y-4">
+                {hiddenField #id}
+                <input type="hidden" name="apiConsumerId" value={show consumer.id} />
+                <div>
+                    <label class="block text-sm font-medium text-gray-700 mb-1">Event Topic *</label>
+                    <select name="eventType" class="border rounded px-3 py-2 text-sm w-full">
+                        {forEach webhookTopics topicOption}
+                    </select>
+                </div>
+                <div>
+                    <label class="block text-sm font-medium text-gray-700 mb-1">Target URL *</label>
+                    {textField #targetUrl}
+                    <p class="text-xs text-gray-400 mt-1">Must be HTTPS. IHF will POST JSON payloads with X-IHF-Signature header.</p>
+                </div>
+                <div class="pt-2 flex gap-3">
+                    <button type="submit" class="bg-indigo-600 text-white text-sm font-medium px-4 py-2 rounded hover:bg-indigo-700">
+                        Create Subscription
+                    </button>
+                    <a href={ShowApiConsumerAction consumer.id} class="text-sm text-gray-500 px-4 py-2 hover:text-gray-700">Cancel</a>
+                </div>
+            </form>
+        </div>
+    |]
+      where
+        topicOption t = [hsx|<option value={t}>{t}</option>|]