fix(WP-0014): pre-flight compilation fixes, Tailwind pipeline, and admin seed

A2 — Compilation fixes:
- Remove inline FK constraints from Schema.sql; IHP schema compiler cannot
  parse them. Add 1744329600-restore-fk-constraints.sql migration to restore
  referential integrity at the DB level.
- Rename `#label` → `#label_` throughout to avoid clash with Haskell built-in.
- Fix `hub.id == hid` UUID comparisons to use `toUUID hub.id`.
- Replace non-existent `setStatus`/`respondJson` calls with
  `renderJsonWithStatusCode` throughout Api controllers.
- Fix qualified package import for `cryptohash-sha256` in Auth.hs.
- Add `CanSelect (Text, Text)` instance in Helper.View.
- Refactor HSX inline lambdas to named helper functions in 100+ views
  (GHC cannot infer types for anonymous functions inside quasi-quoted HSX).
- Fix missing imports (IHP.QueryBuilder, IHP.Fetch, Web.Routes, Only, etc.)
  across helpers and controllers.
- Remove duplicate `diffUTCTime` definition in BottleneckDetector.
- Change `createEventForHub` return type from `IO ResponseReceived` to `IO ()`.
- Seed type-registry vocabulary via 1744502400-seed-type-registries.sql
  (moved from Schema.sql where IHP does not execute INSERT statements).

A3 — Tailwind build pipeline:
- Add `tailwindcss` to flake.nix native packages.
- Uncomment `tailwind.exec` process in devenv shell config.
- Add tailwind/tailwind.config.js (scans Web/View/**/*.hs).
- Add tailwind/app.css with @tailwind directives.

A4 — Admin user seed:
- Add 1744416000-seed-admin-user.sql: inserts admin@inter-hub.local
  with bcrypt-hashed password admin1234! (cost 10).
- Add .env.example documenting all required environment variables
  and default admin credentials.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

Web/Types.hs

@@ -343,6 +343,27 @@ data ApiV2SdkController
 
 -- Phase 10 — Hub Registry and Widget Marketplace (IHUB-WP-0011)
 
+-- | GAAF compliance status derived from manifest and registry.
+data GaafStatus
+    = GaafCompliant          -- active manifest, all declared types registered
+    | GaafNoManifest         -- hub has no active manifest
+    | GaafDraftOnly          -- hub has a draft but no active manifest
+    deriving (Eq, Show, Data)
+
+gaafStatus :: Maybe HubCapabilityManifest -> GaafStatus
+gaafStatus Nothing  = GaafNoManifest
+gaafStatus (Just m)
+    | m.status == "active" = GaafCompliant
+    | m.status == "draft"  = GaafDraftOnly
+    | otherwise            = GaafNoManifest
+
+-- | Aggregated row for the hub registry index.
+data HubRegistryRow = HubRegistryRow
+    { hub             :: !Hub
+    , mManifest       :: !(Maybe HubCapabilityManifest)
+    , mLatestSnapshot :: !(Maybe HubHealthSnapshot)
+    }
+
 data HubRegistryController
     = HubRegistryAction
     | ShowHubRegistryAction { hubId :: !(Id Hub) }