fix(WP-0014/A2): close remaining pure-param and structural compilation errors

Convert all remaining `<- paramOrNothing / param / paramOrDefault /
currentUserOrNothing` monadic binds to `let` — these functions are pure
(ImplicitParams-based) in IHP v1.5, so `<-` is a type error in an IO
do-block.

Controllers fixed:
  AgentDelegations, AiGovernancePolicies, Annotations, ApiConsumers,
  CollectiveProposals, DecisionRecords, DeploymentRecords,
  HubCapabilityManifests, HubRoutingRules, InstitutionalKnowledge,
  OutcomeCorrelations, RequirementCandidates, TypeRegistries,
  WebhookSubscriptions, Widgets,
  Api/V2/{Annotations,InteractionEvents,Token}

WebhookSubscriptions: remove orphaned `Right () ->` case arm that was
left inside a bare `unless` block (structural parse error).

Also carries forward all in-progress fixes from the working tree:
  helpers (AgentBridge, ApiRateLimit, BottleneckDetector,
            CrossHubPropagation, FrictionScore),
  views (CanSelect instances, HSX lambda extraction, formFor wrappers),
  env/build (envrc GHCi perms, flake.nix Tailwind + GHC resource limits,
             static/app.css additional Tailwind output).

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

Web/Controller/WebhookSubscriptions.hs

@@ -32,27 +32,27 @@ instance Controller WebhookSubscriptionsController where
         render NewView { subscription, consumer }
 
     action CreateWebhookSubscriptionAction = do
-        apiConsumerId <- param @(Id ApiConsumer) "apiConsumerId"
+        let apiConsumerId = param @(Id ApiConsumer) "apiConsumerId"
+            eventType     = param @Text "eventType"
+            targetUrl     = param @Text "targetUrl"
         consumer  <- fetch apiConsumerId
-        eventType <- param @Text "eventType"
-        targetUrl <- param @Text "targetUrl"
 
         -- Validate against allowed webhook topics
         unless (eventType `elem` allowedWebhookTopics) $ do
             setErrorMessage ("Unknown webhook topic: " <> eventType)
             redirectTo (NewWebhookSubscriptionAction apiConsumerId)
-            Right () -> do
-                -- Generate HMAC signing secret
-                secretBytes <- liftIO $ Random.random 32
-                let secret = TE.decodeUtf8 (Base16.encode secretBytes)
-                _sub <- newRecord @WebhookSubscription
-                    |> set #apiConsumerId consumer.id
-                    |> set #eventType eventType
-                    |> set #targetUrl targetUrl
-                    |> set #secret secret
-                    |> set #isActive True
-                    |> createRecord
-                redirectTo (ShowApiConsumerAction apiConsumerId)
+
+        -- Generate HMAC signing secret
+        secretBytes <- liftIO $ Random.random 32
+        let secret = TE.decodeUtf8 (Base16.encode secretBytes)
+        _sub <- newRecord @WebhookSubscription
+            |> set #apiConsumerId consumer.id
+            |> set #eventType eventType
+            |> set #targetUrl targetUrl
+            |> set #secret secret
+            |> set #isActive True
+            |> createRecord
+        redirectTo (ShowApiConsumerAction apiConsumerId)
 
     action ToggleWebhookSubscriptionAction { webhookSubscriptionId } = do
         sub     <- fetch webhookSubscriptionId