feat(T02-T11): IHF Phase 1 schema, controllers, views, and helpers

- Schema: hubs, widgets, widget_versions, interaction_events (append-only
  trigger), annotations, users — single migration file
- Web layer: Types, Routes, FrontController with auth + AutoRefresh layout
- Controllers: Hubs (CRUD), Widgets (CRUD + versioning), InteractionEvents
  (JSON capture, canonical event_type validation), Annotations (threaded,
  append-only)
- Sessions controller for IHP auth
- Views: Hubs (index/show/new/edit), Widgets (index/show/new/edit),
  Annotations (index/new), Sessions (login)
- widgetEnvelope helper with full data-* governance attributes
- Integration tests: Hub CRUD, Widget versioning, event capture, append-only
  guard, annotation threading, validation

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

Web/Controller/Annotations.hs

@@ -0,0 +1,48 @@
+module Web.Controller.Annotations where
+
+import Web.Types
+import Web.View.Annotations.Index
+import Web.View.Annotations.New
+import Generated.Types
+import IHP.Prelude
+import IHP.ControllerPrelude
+
+validCategories :: [Text]
+validCategories = ["friction", "defect", "wish", "policy_concern", "doc_gap", "trust", "other"]
+
+instance Controller AnnotationsController where
+    beforeAction = ensureIsUser
+
+    action WidgetAnnotationsAction { widgetId } = do
+        widget      <- fetch widgetId
+        annotations <- query @Annotation
+            |> filterWhere (#widgetId, widgetId)
+            |> orderByAsc #createdAt
+            |> fetch
+        render IndexView { widget, annotations }
+
+    action NewAnnotationAction { widgetId } = do
+        widget <- fetch widgetId
+        let annotation = newRecord @Annotation
+        render NewView { widget, annotation }
+
+    action CreateAnnotationAction { widgetId } = do
+        widget  <- fetch widgetId
+        mUser   <- currentUserOrNothing
+        let actorId   = fmap (.id) mUser
+            actorType = maybe "anonymous" (const "user") mUser
+
+        let annotation = newRecord @Annotation
+        annotation
+            |> fill @'["body", "category", "parentId", "widgetStateRef"]
+            |> set #widgetId  widgetId
+            |> set #actorId   (fmap (Id . unId) actorId)
+            |> set #actorType actorType
+            |> validateField #body nonEmpty
+            |> validateField #category (`elem` validCategories)
+            |> ifValid \case
+                Left annotation -> render NewView { widget, annotation }
+                Right annotation -> do
+                    createRecord annotation
+                    setSuccessMessage "Annotation added"
+                    redirectTo WidgetAnnotationsAction { widgetId }