fix(WP-0014/A2): close remaining pure-param and structural compilation errors

Convert all remaining `<- paramOrNothing / param / paramOrDefault /
currentUserOrNothing` monadic binds to `let` — these functions are pure
(ImplicitParams-based) in IHP v1.5, so `<-` is a type error in an IO
do-block.

Controllers fixed:
  AgentDelegations, AiGovernancePolicies, Annotations, ApiConsumers,
  CollectiveProposals, DecisionRecords, DeploymentRecords,
  HubCapabilityManifests, HubRoutingRules, InstitutionalKnowledge,
  OutcomeCorrelations, RequirementCandidates, TypeRegistries,
  WebhookSubscriptions, Widgets,
  Api/V2/{Annotations,InteractionEvents,Token}

WebhookSubscriptions: remove orphaned `Right () ->` case arm that was
left inside a bare `unless` block (structural parse error).

Also carries forward all in-progress fixes from the working tree:
  helpers (AgentBridge, ApiRateLimit, BottleneckDetector,
            CrossHubPropagation, FrictionScore),
  views (CanSelect instances, HSX lambda extraction, formFor wrappers),
  env/build (envrc GHCi perms, flake.nix Tailwind + GHC resource limits,
             static/app.css additional Tailwind output).

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

Web/Controller/AnnotationThreads.hs

@@ -39,14 +39,14 @@ instance Controller AnnotationThreadsController where
 
     action CreateAnnotationThreadAction { widgetId } = do
         widget <- fetch widgetId
-        mUser  <- currentUserOrNothing
+        let mUser  = currentUserOrNothing
         let createdBy = fmap (.id) mUser
 
         let thread = newRecord @AnnotationThread
         thread
             |> fill @'["title", "description"]
             |> set #widgetId widgetId
-            |> set #createdBy (fmap (Id . unId) createdBy)
+            |> set #createdBy createdBy
             |> validateField #title nonEmpty
             |> ifValid \case
                 Left thread  -> render NewView { widget, thread }
@@ -57,7 +57,7 @@ instance Controller AnnotationThreadsController where
 
     action AssignAnnotationToThreadAction { annotationId } = do
         annotation <- fetch annotationId
-        threadId   <- param @(Id AnnotationThread) "threadId"
+        let threadId = param @(Id AnnotationThread) "threadId"
         annotation
             |> set #threadId (Just threadId)
             |> updateRecord