feat(WP-0009): IHF GAAF Compliance Foundation — type registries, extension manifests, architectural contracts

Implements IHUB-WP-0009: closes four GAAF-2026 gaps before domain hub work begins.
- TypeRegistry helper + controllers/views (hub_kind, hub_capability_manifest)
- HubCapabilityManifest entity with validation and registry linkage
- ARCHITECTURE-LAYERS.md + CI-enforced boundary contracts
- Alembic migration 1743724800, fitness tests (Test/Architecture/)
- GAAF spec, Operational Architecture spec, domain hub extension guide
- Updates to CLAUDE.md, SCOPE.md, Schema.sql, Routes, FrontController, Types

state_hub_sync: pending (tunnel was STALE at completion time; run fix-consistency)

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

Web/Controller/Hubs.hs

@@ -46,15 +46,20 @@ instance Controller HubsController where
         recentAnnotations <- sqlQuery
             "SELECT * FROM annotations WHERE widget_id = ANY(?) ORDER BY created_at DESC LIMIT 20"
             (Only (PGArray widgetIds))
-        render ShowView { hub, widgets, recentEvents, recentAnnotations }
+        mManifest <- query @HubCapabilityManifest
+            |> filterWhere (#hubId, hubId)
+            |> fetchOneOrNothing
+        render ShowView { hub, widgets, recentEvents, recentAnnotations, mManifest }
 
     action CreateHubAction = do
         let hub = newRecord @Hub
         hub
-            |> fill @'["slug", "name", "domain"]
+            |> fill @'["slug", "name", "domain", "hubKind"]
             |> validateField #slug nonEmpty
             |> validateField #name nonEmpty
             |> validateField #domain nonEmpty
+            |> validateField #hubKind (`elem` ["domain", "shared"])
+            -- 'framework' cannot be set via the UI
             |> ifValid \case
                 Left hub -> render NewView { hub }
                 Right hub -> do
@@ -69,10 +74,11 @@ instance Controller HubsController where
     action UpdateHubAction { hubId } = do
         hub <- fetch hubId
         hub
-            |> fill @'["slug", "name", "domain"]
+            |> fill @'["slug", "name", "domain", "hubKind"]
             |> validateField #slug nonEmpty
             |> validateField #name nonEmpty
             |> validateField #domain nonEmpty
+            |> validateField #hubKind (`elem` ["framework", "domain", "shared"])
             |> ifValid \case
                 Left hub -> render EditView { hub }
                 Right hub -> do