feat(T02-T11): IHF Phase 1 schema, controllers, views, and helpers

- Schema: hubs, widgets, widget_versions, interaction_events (append-only
  trigger), annotations, users — single migration file
- Web layer: Types, Routes, FrontController with auth + AutoRefresh layout
- Controllers: Hubs (CRUD), Widgets (CRUD + versioning), InteractionEvents
  (JSON capture, canonical event_type validation), Annotations (threaded,
  append-only)
- Sessions controller for IHP auth
- Views: Hubs (index/show/new/edit), Widgets (index/show/new/edit),
  Annotations (index/new), Sessions (login)
- widgetEnvelope helper with full data-* governance attributes
- Integration tests: Hub CRUD, Widget versioning, event capture, append-only
  guard, annotation threading, validation

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

Web/Controller/InteractionEvents.hs

@@ -0,0 +1,55 @@
+module Web.Controller.InteractionEvents where
+
+import Web.Types
+import Generated.Types
+import IHP.Prelude
+import IHP.ControllerPrelude
+import Data.Aeson (object, (.=))
+import qualified Data.Text as T
+
+-- Valid canonical event types
+validEventTypes :: [Text]
+validEventTypes =
+    [ "viewed", "clicked", "submitted", "abandoned", "retried", "failed"
+    , "commented", "flagged_confusing", "flagged_helpful"
+    , "blocked_by_policy", "escalated"
+    , "accepted_recommendation", "rejected_recommendation"
+    ]
+
+instance Controller InteractionEventsController where
+    action CreateInteractionEventAction { widgetId } = do
+        eventType <- param @Text "event_type"
+        unless (eventType `elem` validEventTypes) do
+            respondJson (object ["error" .= ("unknown event_type" :: Text), "valid" .= validEventTypes])
+            -- IHP stops here; the above respondJson sends 200 but we need 422
+            -- Use renderWithStatus for proper 422:
+            setStatus 422
+            respondJson (object ["error" .= ("unknown event_type" :: Text)])
+
+        mUser <- currentUserOrNothing
+        let actorId   = fmap (.id) mUser
+            actorType = maybe "anonymous" (const "user") mUser
+
+        actorTypeParam <- paramOrDefault @Text actorType "actor_type"
+        viewContextRef <- paramOrNothing @Text "view_context_ref"
+        metadataRaw    <- paramOrDefault @Text "{}" "metadata"
+
+        let metadata = case readMay @Value (cs metadataRaw) of
+                Just v  -> v
+                Nothing -> object []
+
+        event <- newRecord @InteractionEvent
+            |> set #widgetId       widgetId
+            |> set #eventType      eventType
+            |> set #actorId        (fmap (Id . unId) actorId)
+            |> set #actorType      actorTypeParam
+            |> set #viewContextRef viewContextRef
+            |> set #metadata       metadata
+            |> createRecord
+
+        respondJson (object
+            [ "id"         .= event.id
+            , "widget_id"  .= event.widgetId
+            , "event_type" .= event.eventType
+            , "occurred_at".= event.occurredAt
+            ])