fix(WP-0014): pre-flight compilation fixes, Tailwind pipeline, and admin seed

A2 — Compilation fixes:
- Remove inline FK constraints from Schema.sql; IHP schema compiler cannot
  parse them. Add 1744329600-restore-fk-constraints.sql migration to restore
  referential integrity at the DB level.
- Rename `#label` → `#label_` throughout to avoid clash with Haskell built-in.
- Fix `hub.id == hid` UUID comparisons to use `toUUID hub.id`.
- Replace non-existent `setStatus`/`respondJson` calls with
  `renderJsonWithStatusCode` throughout Api controllers.
- Fix qualified package import for `cryptohash-sha256` in Auth.hs.
- Add `CanSelect (Text, Text)` instance in Helper.View.
- Refactor HSX inline lambdas to named helper functions in 100+ views
  (GHC cannot infer types for anonymous functions inside quasi-quoted HSX).
- Fix missing imports (IHP.QueryBuilder, IHP.Fetch, Web.Routes, Only, etc.)
  across helpers and controllers.
- Remove duplicate `diffUTCTime` definition in BottleneckDetector.
- Change `createEventForHub` return type from `IO ResponseReceived` to `IO ()`.
- Seed type-registry vocabulary via 1744502400-seed-type-registries.sql
  (moved from Schema.sql where IHP does not execute INSERT statements).

A3 — Tailwind build pipeline:
- Add `tailwindcss` to flake.nix native packages.
- Uncomment `tailwind.exec` process in devenv shell config.
- Add tailwind/tailwind.config.js (scans Web/View/**/*.hs).
- Add tailwind/app.css with @tailwind directives.

A4 — Admin user seed:
- Add 1744416000-seed-admin-user.sql: inserts admin@inter-hub.local
  with bcrypt-hashed password admin1234! (cost 10).
- Add .env.example documenting all required environment variables
  and default admin credentials.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

Application/Helper/AgentBridge.hs

@@ -8,10 +8,13 @@ import IHP.Prelude
 import IHP.ControllerPrelude
 import Data.Aeson (object, (.=), encode, decode, Value, FromJSON(..), (.:), (.:?))
 import qualified Data.Aeson as A
+import qualified Data.Aeson.KeyMap as KM
+import qualified Data.Aeson.Key as AK
 import qualified Data.ByteString.Lazy as LBS
 import System.Process (readProcessWithExitCode)
 import System.Exit (ExitCode(..))
 import Generated.Types
+import Web.Routes ()
 
 -- ---------------------------------------------------------------------------
 -- Request / response types
@@ -167,7 +170,7 @@ callBridgeBatch reqs = do
         readProcessWithExitCode "python3" ["scripts/llm_bridge.py"] (cs payload)
     let outBytes = LBS.fromStrict (cs stdout)
     case A.decode @A.Value outBytes of
-        Just (A.Object o) | Just (A.Array arr) <- A.lookup "results" o ->
+        Just (A.Object o) | Just (A.Array arr) <- KM.lookup (AK.fromString "results") o ->
             pure $ map parseResult (toList arr)
         _ ->
             pure $ replicate (length reqs) (Left (BridgeError "Unparseable batch output" "ParseError"))

Application/Helper/ApiRateLimit.hs

@@ -7,6 +7,7 @@ import Generated.Types
 import IHP.Prelude
 import IHP.ModelSupport
 import IHP.ControllerPrelude
+import Web.Routes ()
 import Data.Aeson (object, (.=))
 import Database.PostgreSQL.Simple (Only(..))
 import Web.Controller.Api.V2.Auth (respondWithStatus)

Application/Helper/BottleneckDetector.hs

@@ -2,8 +2,12 @@ module Application.Helper.BottleneckDetector where
 
 import IHP.Prelude
 import IHP.ModelSupport
+import IHP.QueryBuilder
+import IHP.Fetch
 import Generated.Types
+import Web.Routes ()
 import Data.Time.Clock (addUTCTime, getCurrentTime, NominalDiffTime)
+import Database.PostgreSQL.Simple (Only(..))
 
 -- | Severity based on how much older than the threshold the record is.
 staleSeverity :: NominalDiffTime -> NominalDiffTime -> Text
@@ -97,5 +101,3 @@ detectBottlenecks hubId hubWidgets candidates requirements decisions deployments
 
     pure (r1 <> r2 <> r3 <> r4)
 
-diffUTCTime :: UTCTime -> UTCTime -> NominalDiffTime
-diffUTCTime a b = realToFrac (a `Data.Time.Clock.diffUTCTime` b)

Application/Helper/Controller.hs

@@ -2,6 +2,7 @@ module Application.Helper.Controller where
 
 import IHP.ControllerPrelude
 import Generated.Types
+import Web.Routes ()
 import Data.Time.Clock (addUTCTime)
 import Data.List (sortBy)
 

Application/Helper/CorrelationEngine.hs

@@ -3,7 +3,8 @@ module Application.Helper.CorrelationEngine where
 import IHP.Prelude
 import Generated.Types
 import IHP.ModelSupport (sqlQuery)
-import Database.PostgreSQL.Simple (Only(..))
+import Web.Routes ()
+import Database.PostgreSQL.Simple (Only(..), (:.)(..))
 
 -- | For a hub, compute the correlation score per annotation category:
 -- fraction of traceability chains ending in a positive outcome signal
@@ -28,4 +29,4 @@ computeAnnotationCorrelations hubId =
         \ WHERE w.hub_id = ? \
         \ GROUP BY a.category \
         \ ORDER BY score DESC"
-        [hubId]
+        (Only hubId)

Application/Helper/CrossHubPropagation.hs

@@ -2,7 +2,10 @@ module Application.Helper.CrossHubPropagation where
 
 import IHP.Prelude
 import IHP.ModelSupport
+import IHP.QueryBuilder
+import IHP.Fetch
 import Generated.Types
+import Web.Routes ()
 import Data.Time.Clock (addUTCTime, getCurrentTime)
 import Data.Aeson (toJSON)
 import qualified Data.List as List

Application/Helper/FrictionScore.hs

@@ -2,7 +2,11 @@ module Application.Helper.FrictionScore where
 
 import IHP.Prelude
 import IHP.ModelSupport
+import IHP.QueryBuilder
+import IHP.Fetch
 import Generated.Types
+import Web.Routes ()
+import Database.PostgreSQL.Simple (Only(..))
 import Data.Time.Clock (addUTCTime, getCurrentTime)
 import qualified Data.Aeson as A
 import qualified Data.HashMap.Strict as H

Application/Helper/HubHealth.hs

@@ -3,6 +3,7 @@ module Application.Helper.HubHealth where
 import IHP.Prelude
 import IHP.ModelSupport
 import Generated.Types
+import Web.Routes ()
 import Data.Time.Clock (addUTCTime, getCurrentTime)
 
 -- | Health score deduction table (documented):
@@ -50,7 +51,7 @@ computeHubHealth hubId widgets candidates decisions deployments signals annotati
         score = max 0 (100 - deductions)
 
     newRecord @HubHealthSnapshot
-        |> set #hubId           hubId
+        |> set #hubId           (toUUID hubId)
         |> set #healthScore     score
         |> set #openCandidates  openCount
         |> set #regressedWidgets regCount

Application/Helper/ModelRouter.hs

@@ -6,6 +6,7 @@ module Application.Helper.ModelRouter where
 import IHP.Prelude
 import IHP.ControllerPrelude
 import Generated.Types
+import Web.Routes ()
 import Database.PostgreSQL.Simple (Only(..))
 
 -- | Resolve the highest-priority active AgentRegistration for the given hub

Application/Helper/RoutingEngine.hs

@@ -2,7 +2,10 @@ module Application.Helper.RoutingEngine where
 
 import IHP.Prelude
 import IHP.ModelSupport
+import IHP.QueryBuilder
+import IHP.Fetch
 import Generated.Types
+import Web.Routes ()
 
 -- | Apply active routing rules to a RequirementCandidate.
 -- Finds the highest-priority matching active rule for the candidate's hub

Application/Helper/TypeRegistry.hs

@@ -3,6 +3,7 @@ module Application.Helper.TypeRegistry where
 import IHP.Prelude
 import IHP.ModelSupport
 import Generated.Types
+import Web.Routes ()
 import Database.PostgreSQL.Simple (Only(..))
 
 -- | Validate that a type name exists in widget_type_registry with status='active'.

Application/Helper/View.hs

@@ -3,6 +3,15 @@ module Application.Helper.View where
 import IHP.ViewPrelude
 import Generated.Types
 import Web.Types
+import Web.Routes ()
+import IHP.View.Form.Select (CanSelect(..))
+
+-- | CanSelect instance for (Text, Text) tuples where fst is the label
+-- and snd is the value. Used by selectField when options are plain text pairs.
+instance CanSelect (Text, Text) where
+    type SelectValue (Text, Text) = Text
+    selectLabel = fst
+    selectValue = snd
 
 -- | Widget Envelope — wraps any widget's rendered content with IHF governance metadata.
 --
@@ -44,7 +53,7 @@ widgetEnvelope widget inner =
         {renderEnvelopeWarnings warnings}
         {inner}
         <div class="ihf-widget-controls mt-2">
-            <a href={WidgetAnnotationsAction { widgetId = widget.id }}
+            <a href={WidgetAnnotationsAction (widget.id)}
                class="ihf-annotate-btn text-xs text-gray-400 hover:text-indigo-600 border border-gray-200
                       rounded px-2 py-0.5 hover:border-indigo-300">
                 Annotate
@@ -70,10 +79,13 @@ renderEnvelopeWarnings [] = mempty
 renderEnvelopeWarnings ws = [hsx|
     <div class="bg-amber-50 border border-amber-200 rounded px-3 py-1 mb-1 text-xs text-amber-700">
         <strong>Envelope contract warning:</strong>
-        {forEach ws (\w -> [hsx|<div>{w}</div>|])}
+        {forEach ws renderWarningLine}
     </div>
 |]
 
+renderWarningLine :: Text -> Html
+renderWarningLine w = [hsx|<div>{w}</div>|]
+
 -- | Status badge colour for WidgetAdapterSpec and contract status values.
 adapterStatusBadge :: Text -> Text
 adapterStatusBadge "active"     = "bg-green-100 text-green-800"