fix(WP-0014/A2): close remaining pure-param and structural compilation errors

Convert all remaining `<- paramOrNothing / param / paramOrDefault /
currentUserOrNothing` monadic binds to `let` — these functions are pure
(ImplicitParams-based) in IHP v1.5, so `<-` is a type error in an IO
do-block.

Controllers fixed:
  AgentDelegations, AiGovernancePolicies, Annotations, ApiConsumers,
  CollectiveProposals, DecisionRecords, DeploymentRecords,
  HubCapabilityManifests, HubRoutingRules, InstitutionalKnowledge,
  OutcomeCorrelations, RequirementCandidates, TypeRegistries,
  WebhookSubscriptions, Widgets,
  Api/V2/{Annotations,InteractionEvents,Token}

WebhookSubscriptions: remove orphaned `Right () ->` case arm that was
left inside a bare `unless` block (structural parse error).

Also carries forward all in-progress fixes from the working tree:
  helpers (AgentBridge, ApiRateLimit, BottleneckDetector,
            CrossHubPropagation, FrictionScore),
  views (CanSelect instances, HSX lambda extraction, formFor wrappers),
  env/build (envrc GHCi perms, flake.nix Tailwind + GHC resource limits,
             static/app.css additional Tailwind output).

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

Web/Controller/Api/V2/Token.hs

@@ -10,7 +10,7 @@ import IHP.ControllerPrelude
 import Data.Aeson (object, (.=))
 import qualified Data.Text as T
 import qualified Data.Text.Encoding as TE
-import qualified Crypto.Hash.SHA256 as SHA256
+import qualified "cryptohash-sha256" Crypto.Hash.SHA256 as SHA256
 import qualified Data.ByteString.Base16 as Base16
 import qualified Data.ByteString.Random as Random
 import Data.Time (addUTCTime)
@@ -23,10 +23,10 @@ instance Controller ApiV2TokenController where
         when (requestMethod ?request /= "POST") do
             respondWithStatus 405 $ object ["error" .= ("Method not allowed" :: Text)]
 
-        grantType    <- paramOrNothing @Text "grant_type"
-        clientId     <- paramOrNothing @Text "client_id"
-        clientSecret <- paramOrNothing @Text "client_secret"
-        mScope       <- paramOrNothing @Text "scope"
+        let grantType    = paramOrNothing @Text "grant_type"
+            clientId     = paramOrNothing @Text "client_id"
+            clientSecret = paramOrNothing @Text "client_secret"
+            mScope       = paramOrNothing @Text "scope"
 
         -- grant_type must be client_credentials
         case grantType of