fix(WP-0014/A2): close remaining pure-param and structural compilation errors

Convert all remaining `<- paramOrNothing / param / paramOrDefault /
currentUserOrNothing` monadic binds to `let` — these functions are pure
(ImplicitParams-based) in IHP v1.5, so `<-` is a type error in an IO
do-block.

Controllers fixed:
  AgentDelegations, AiGovernancePolicies, Annotations, ApiConsumers,
  CollectiveProposals, DecisionRecords, DeploymentRecords,
  HubCapabilityManifests, HubRoutingRules, InstitutionalKnowledge,
  OutcomeCorrelations, RequirementCandidates, TypeRegistries,
  WebhookSubscriptions, Widgets,
  Api/V2/{Annotations,InteractionEvents,Token}

WebhookSubscriptions: remove orphaned `Right () ->` case arm that was
left inside a bare `unless` block (structural parse error).

Also carries forward all in-progress fixes from the working tree:
  helpers (AgentBridge, ApiRateLimit, BottleneckDetector,
            CrossHubPropagation, FrictionScore),
  views (CanSelect instances, HSX lambda extraction, formFor wrappers),
  env/build (envrc GHCi perms, flake.nix Tailwind + GHC resource limits,
             static/app.css additional Tailwind output).

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

Web/Controller/ApiInteractionEvents.hs

@@ -10,6 +10,7 @@ import Network.Wai (requestMethod, requestHeaders, responseLBS, ResponseReceived
 import Network.HTTP.Types (status201, status401, status403, status405, status422)
 import IHP.Controller.Render (renderJson, renderJsonWithStatusCode)
 import Application.Helper.TypeRegistry (validateEventType)
+import qualified Data.UUID as UUID
 
 instance Controller ApiInteractionEventsController where
 
@@ -41,9 +42,9 @@ instance Controller ApiInteractionEventsController where
 createEventForHub :: (?context :: ControllerContext, ?modelContext :: ModelContext, ?respond :: Respond, ?request :: Request) => Hub -> IO ()
 createEventForHub hub = do
     -- Validate required fields per contract v1.0
-    widgetIdText <- paramOrNothing @Text "widget_id"
-    eventType    <- paramOrNothing @Text "event_type"
-    _occurredAt  <- paramOrNothing @Text "occurred_at"
+    let widgetIdText = paramOrNothing @Text "widget_id"
+        eventType    = paramOrNothing @Text "event_type"
+        _occurredAt  = paramOrNothing @Text "occurred_at"
 
     let missing = catMaybes
             [ if isNothing widgetIdText then Just ("widget_id"  :: Text) else Nothing
@@ -70,7 +71,7 @@ createEventForHub hub = do
         Right () -> pure ()
 
     -- Resolve widget — must belong to this hub.
-    case readMay wIdText of
+    case UUID.fromText wIdText of
         Nothing -> do
             renderJsonWithStatusCode status422 (object ["error" .= ("widget_id must be a valid UUID" :: Text)])
         Just rawId -> do