feat(T02-T11): IHF Phase 1 schema, controllers, views, and helpers

- Schema: hubs, widgets, widget_versions, interaction_events (append-only
  trigger), annotations, users — single migration file
- Web layer: Types, Routes, FrontController with auth + AutoRefresh layout
- Controllers: Hubs (CRUD), Widgets (CRUD + versioning), InteractionEvents
  (JSON capture, canonical event_type validation), Annotations (threaded,
  append-only)
- Sessions controller for IHP auth
- Views: Hubs (index/show/new/edit), Widgets (index/show/new/edit),
  Annotations (index/new), Sessions (login)
- widgetEnvelope helper with full data-* governance attributes
- Integration tests: Hub CRUD, Widget versioning, event capture, append-only
  guard, annotation threading, validation

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

Web/Controller/Sessions.hs

@@ -0,0 +1,29 @@
+module Web.Controller.Sessions where
+
+import Web.Types
+import Web.View.Sessions.New
+import Generated.Types
+import IHP.LoginSupport.Helper.Controller
+import IHP.Prelude
+import IHP.ControllerPrelude
+
+instance Controller SessionsController where
+    action NewSessionAction = do
+        let user = newRecord @User
+        render NewView { user }
+
+    action CreateSessionAction = do
+        (user, token) <- authenticate @User
+        case user of
+            Just user -> do
+                setSession "userId" (show user.id)
+                redirectTo HubsAction
+            Nothing -> do
+                setErrorMessage "Invalid email or password"
+                redirectTo NewSessionAction
+
+    action DeleteSessionAction = do
+        unsetSession "userId"
+        redirectTo NewSessionAction
+
+instance SessionsControllerConfig User