docs: align v2 bootstrap api contract

contracts/functional/interaction-reporting-v1.md

@@ -126,14 +126,28 @@ Domain hubs may register additional event types via `HubCapabilityManifest`.
 
 ## Phase 9 Extension: `/api/v2/` (IHUB-WP-0010)
 
-The v2 API supersedes per-hub Bearer tokens with OAuth 2.0 client credentials.
+The v2 API supports authenticated Bearer access with static API keys and, where
+configured, OAuth 2.0 client credentials.
 
 **OpenAPI spec:** `/api/v2/openapi.json` (live-generated; `widget_type`,
 `event_type`, and `category` fields carry `enum` arrays from the type registries)
 
 **New endpoints in v2:**
 - `POST /api/v2/token` — OAuth 2.0 client credentials token exchange
+- `GET /api/v2/hubs` / `POST /api/v2/hubs` — list or create hubs, including
+  first-class VSM hub metadata
+- `GET /api/v2/hub-capability-manifests` / `POST /api/v2/hub-capability-manifests`
+  — list or create hub capability manifests
+- `PATCH /api/v2/hub-capability-manifests/{id}` — update draft manifest
+  vocabulary and metadata
+- `POST /api/v2/hub-capability-manifests/{id}/activate` — activate a draft
+  manifest and register its declared vocabulary
+- `GET /api/v2/api-consumers` / `POST /api/v2/api-consumers` — list or create
+  API consumers
+- `POST /api/v2/api-consumers/{id}/api-keys` — create a static API key; the
+  raw `fullKey` is returned exactly once
 - `GET /api/v2/widgets` — paginated widget listing
+- `POST /api/v2/widgets` — create a widget
 - `GET /api/v2/interaction-events` — paginated event listing
 - `POST /api/v2/interaction-events` — submit event (registry-validated)
 - `GET /api/v2/annotations` — paginated annotation listing