feat: add v2 hub and widget create endpoints

workplans/IHUB-WP-0019-vsm-hub-bootstrap-api.md

@@ -79,7 +79,7 @@ The same shape should later work for:
 
 ```task
 id: IHUB-WP-0019-T01
-status: todo
+status: done
 priority: high
 state_hub_task_id: "72c5b7b2-632f-42ab-ac4d-eff123d8f143"
 ```
@@ -101,6 +101,15 @@ The endpoints should validate the same invariants as the UI controllers:
 Done when: a script can create a hub row and seed widgets without direct DB
 access.
 
+Implementation note (2026-05-16): added authenticated v2 `POST /api/v2/hubs`
+and `POST /api/v2/widgets`, with required-field validation, hub-kind/status
+validation, widget type and policy-scope registry checks, hub existence checks,
+initial widget-version snapshots, OpenAPI path entries, SDK helper methods, and
+focused Hspec helper coverage. The collection controllers now dispatch
+GET/POST by HTTP method so the create routes are reachable. Local
+`git diff --check` passed; `scripts/compile-check` could not run because this
+shell does not have `IHP_LIB`/the IHP dev environment loaded.
+
 ---
 
 ### T02 — Add manifest and policy-scope API support