fix(WP-0014/A2): close remaining pure-param and structural compilation errors

Convert all remaining `<- paramOrNothing / param / paramOrDefault /
currentUserOrNothing` monadic binds to `let` — these functions are pure
(ImplicitParams-based) in IHP v1.5, so `<-` is a type error in an IO
do-block.

Controllers fixed:
  AgentDelegations, AiGovernancePolicies, Annotations, ApiConsumers,
  CollectiveProposals, DecisionRecords, DeploymentRecords,
  HubCapabilityManifests, HubRoutingRules, InstitutionalKnowledge,
  OutcomeCorrelations, RequirementCandidates, TypeRegistries,
  WebhookSubscriptions, Widgets,
  Api/V2/{Annotations,InteractionEvents,Token}

WebhookSubscriptions: remove orphaned `Right () ->` case arm that was
left inside a bare `unless` block (structural parse error).

Also carries forward all in-progress fixes from the working tree:
  helpers (AgentBridge, ApiRateLimit, BottleneckDetector,
            CrossHubPropagation, FrictionScore),
  views (CanSelect instances, HSX lambda extraction, formFor wrappers),
  env/build (envrc GHCi perms, flake.nix Tailwind + GHC resource limits,
             static/app.css additional Tailwind output).

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

flake.nix

@@ -55,8 +55,8 @@
                         ihp-hspec
                     ];
 
-                    # Hoogle documentation server (enabled by default on port 8002)
-                    # withHoogle = false; # Disable to save memory
+                    # Hoogle documentation server — disabled to save ~400 MB on constrained host
+                    withHoogle = false;
 
                     # Disable relation type machinery for faster compilation
                     # relationSupport = false;
@@ -85,6 +85,14 @@
                     # PostgreSQL extensions
                     # services.postgres.extensions = extensions: [ extensions.postgis ];
 
+                    # Resource limits for constrained host (2 CPU, ~3.8 GiB RAM).
+                    # -A32m: smaller minor heap (reduces GC pressure).
+                    # -M2g: hard heap ceiling (prevents OOM on large compiles).
+                    # Note: -N1 is intentionally omitted — it requires -threaded and
+                    # would break build-generated-code and similar tools.
+                    # GHC parallel module compilation is capped via -j1 in .ghci.
+                    env.GHCRTS = "-A32m -M2g";
+
                     # Custom processes that don't appear in https://devenv.sh/reference/options/
                     processes = {
                         tailwind.exec = "tailwindcss -c tailwind/tailwind.config.js -i ./tailwind/app.css -o static/app.css --watch=always";