fix(WP-0017/E1): Layer 2 + Sessions fixes

- CrossHubPropagation: IHP.Prelude.head returns Maybe a; use List.head
  (Data.List.head, already imported qualified) for non-empty-guarded lists
- Sessions: currentUserOrNothing is pure Maybe, not IO; use case...of instead of >>=

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

Web/Controller/Sessions.hs

@@ -27,7 +27,7 @@ instance Controller SessionsController where
                 redirectTo NewSessionAction
 
     action DeleteSessionAction = do
-        currentUserOrNothing @User >>= \case
+        case currentUserOrNothing @User of
             Just user -> logout user >> redirectTo NewSessionAction
             Nothing   -> redirectTo NewSessionAction