feat(WP-0010): IHF Phase 9 — External API Surface and Consumer SDKs

Delivers the full Phase 9 external API layer:

- Versioned REST API (/api/v2/) with OpenAPI 3.1 spec; enum arrays for
  widget_type, event_type, annotation category drawn live from registry tables
- OAuth 2.0 client credentials flow (/api/v2/token); hub:*:write scopes
  gated on active HubCapabilityManifest FK
- API key management: SHA256-hashed tokens, key_prefix for display,
  one-time reveal on creation, revocation support
- TypeScript and Python consumer SDKs generated from registry tables
  (/api/v2/sdk/ihf-client.ts, /api/v2/sdk/ihf-client.py)
- Webhook delivery: HMAC-SHA256 signing, append-only webhook_deliveries,
  fire-and-forget dispatch via forkIO, 3-retry logic
- Admin API dashboard with 24h stats (request count, error rate, last seen)
- Rate limiting (per-minute) and daily quota enforcement via api_request_log
- Schema migration: api_consumers, api_keys, webhook_subscriptions (CHECK
  constraint on 6 framework lifecycle topics), webhook_deliveries
  (append-only trigger), api_request_log
- ARCHITECTURE-LAYERS.md scorecard: 3.34 → 3.41 (approaching Strong)
- contracts/functional/interaction-reporting-v1.md extended with Phase 9
  endpoint catalogue and 422 validation error format

GAAF: no bare TEXT discriminators; webhook event_type uses CHECK constraint
over 6 allowed framework lifecycle topic strings (not widget event types).

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

contracts/functional/interaction-reporting-v1.md

@@ -121,3 +121,37 @@ Domain hubs may register additional event types via `HubCapabilityManifest`.
 - Controller: `Web/Controller/ApiInteractionEvents.hs`
 - Route: `Web/Routes.hs` (`CanRoute ApiInteractionEventsController`)
 - DB record: `interaction_reporting_contracts` (contract_version = '1.0')
+
+---
+
+## Phase 9 Extension: `/api/v2/` (IHUB-WP-0010)
+
+The v2 API supersedes per-hub Bearer tokens with OAuth 2.0 client credentials.
+
+**OpenAPI spec:** `/api/v2/openapi.json` (live-generated; `widget_type`,
+`event_type`, and `category` fields carry `enum` arrays from the type registries)
+
+**New endpoints in v2:**
+- `POST /api/v2/token` — OAuth 2.0 client credentials token exchange
+- `GET /api/v2/widgets` — paginated widget listing
+- `GET /api/v2/interaction-events` — paginated event listing
+- `POST /api/v2/interaction-events` — submit event (registry-validated)
+- `GET /api/v2/annotations` — paginated annotation listing
+- `POST /api/v2/annotations` — submit annotation (registry-validated)
+- `GET /api/v2/requirement-candidates` — paginated candidates
+- `GET /api/v2/decision-records` — paginated decisions
+- `GET /api/v2/deployment-records` — paginated deployments
+- `GET /api/v2/outcome-signals` — paginated outcome signals
+- `GET /api/v2/event-types` — public registry enumeration
+- `GET /api/v2/widget-types` — public registry enumeration
+- `GET /api/v2/annotation-categories` — public registry enumeration
+- `GET /api/v2/sdk/ihf-client.ts` — TypeScript SDK
+- `GET /api/v2/sdk/ihf-client.py` — Python SDK
+- `GET /api/v2/docs` — Swagger UI
+
+**Validation:** Unregistered `event_type` returns HTTP 422 with:
+```json
+{ "code": "unregistered_event_type", "registry": "/api/v2/event-types" }
+```
+
+v1.0 (`/api/v1/`) remains supported. New consumers should use v2.