fix(WP-0014/A2): close remaining pure-param and structural compilation errors

Convert all remaining `<- paramOrNothing / param / paramOrDefault /
currentUserOrNothing` monadic binds to `let` — these functions are pure
(ImplicitParams-based) in IHP v1.5, so `<-` is a type error in an IO
do-block.

Controllers fixed:
  AgentDelegations, AiGovernancePolicies, Annotations, ApiConsumers,
  CollectiveProposals, DecisionRecords, DeploymentRecords,
  HubCapabilityManifests, HubRoutingRules, InstitutionalKnowledge,
  OutcomeCorrelations, RequirementCandidates, TypeRegistries,
  WebhookSubscriptions, Widgets,
  Api/V2/{Annotations,InteractionEvents,Token}

WebhookSubscriptions: remove orphaned `Right () ->` case arm that was
left inside a bare `unless` block (structural parse error).

Also carries forward all in-progress fixes from the working tree:
  helpers (AgentBridge, ApiRateLimit, BottleneckDetector,
            CrossHubPropagation, FrictionScore),
  views (CanSelect instances, HSX lambda extraction, formFor wrappers),
  env/build (envrc GHCi perms, flake.nix Tailwind + GHC resource limits,
             static/app.css additional Tailwind output).

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

Web/Controller/Api/V2/Annotations.hs

@@ -9,14 +9,15 @@ import Web.Controller.Api.V2.Auth
     ( requireApiConsumer, paginatedResponse, getPageParams
     , respondWithStatus )
 import Application.Helper.TypeRegistry (validateAnnotationCategory)
+import qualified Data.UUID as UUID
 
 instance Controller ApiV2AnnotationsController where
 
     action ApiV2IndexAnnotationsAction = do
         _consumer <- requireApiConsumer
         (page, perPage) <- getPageParams
-        mWidgetId <- paramOrNothing @(Id Widget) "widgetId"
-        mCategory <- paramOrNothing @Text "category"
+        let mWidgetId = paramOrNothing @(Id Widget) "widgetId"
+            mCategory = paramOrNothing @Text "category"
         let off = (page - 1) * perPage
         let baseQ = query @Annotation |> orderByDesc #createdAt
         let q1 = case mWidgetId of
@@ -37,9 +38,9 @@ instance Controller ApiV2AnnotationsController where
     -- POST /api/v2/annotations
     action ApiV2CreateAnnotationAction = do
         _consumer <- requireApiConsumer
-        widgetIdText <- paramOrNothing @Text "widgetId"
-        category     <- paramOrNothing @Text "category"
-        body         <- paramOrNothing @Text "body"
+        let widgetIdText = paramOrNothing @Text "widgetId"
+            category     = paramOrNothing @Text "category"
+            body         = paramOrNothing @Text "body"
 
         let missing = catMaybes
                 [ if isNothing widgetIdText then Just ("widgetId" :: Text) else Nothing
@@ -66,7 +67,7 @@ instance Controller ApiV2AnnotationsController where
                 ]
             Right () -> pure ()
 
-        case readMay wIdText of
+        case UUID.fromText wIdText of
             Nothing -> respondWithStatus 422 $ object
                 ["error" .= ("widgetId must be a valid UUID" :: Text)]
             Just rawId -> do
@@ -82,7 +83,6 @@ instance Controller ApiV2AnnotationsController where
                             |> set #body bodyTxt
                             |> set #actorType "api"
                             |> createRecord
-                        setStatus 201
                         renderJson (annotationToJson ann)
 
 annotationToJson :: Annotation -> Value