fix(WP-0014/A2): close remaining pure-param and structural compilation errors

Convert all remaining `<- paramOrNothing / param / paramOrDefault /
currentUserOrNothing` monadic binds to `let` — these functions are pure
(ImplicitParams-based) in IHP v1.5, so `<-` is a type error in an IO
do-block.

Controllers fixed:
  AgentDelegations, AiGovernancePolicies, Annotations, ApiConsumers,
  CollectiveProposals, DecisionRecords, DeploymentRecords,
  HubCapabilityManifests, HubRoutingRules, InstitutionalKnowledge,
  OutcomeCorrelations, RequirementCandidates, TypeRegistries,
  WebhookSubscriptions, Widgets,
  Api/V2/{Annotations,InteractionEvents,Token}

WebhookSubscriptions: remove orphaned `Right () ->` case arm that was
left inside a bare `unless` block (structural parse error).

Also carries forward all in-progress fixes from the working tree:
  helpers (AgentBridge, ApiRateLimit, BottleneckDetector,
            CrossHubPropagation, FrictionScore),
  views (CanSelect instances, HSX lambda extraction, formFor wrappers),
  env/build (envrc GHCi perms, flake.nix Tailwind + GHC resource limits,
             static/app.css additional Tailwind output).

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

.envrc

@@ -31,4 +31,21 @@ fi
 # SMTP config for local development.
 export SMTP_HOST="127.0.0.1" # On some computers may need `127.0.1.1` instead.
 export SMTP_PORT="1025"
-export SMTP_ENCRYPTION="Unencrypted"
+export SMTP_ENCRYPTION="Unencrypted"
+
+# GHCi security: prevent "WARNING: . is writable by someone else, IGNORING!"
+# which causes .ghci (and applicationGhciConfig) to be skipped, breaking
+# the IHP source-path setup (-ibuild, -iConfig, etc.).
+chmod go-w .
+
+# IHP_LIB: path to the IHP lib/IHP directory containing applicationGhciConfig.
+# Required for manual GHCi invocation (devenv up / RunDevServer sets this
+# internally). Derived from the devenv profile's RunDevServer binary.
+if [ -f "$PWD/.devenv/profile/bin/RunDevServer" ]; then
+    _ihp_base=$(strings "$PWD/.devenv/profile/bin/RunDevServer" 2>/dev/null \
+        | grep -m1 'ihp-ide.*data.*/lib$')
+    if [ -n "$_ihp_base" ]; then
+        export IHP_LIB="$_ihp_base/IHP"
+    fi
+    unset _ihp_base
+fi