Create a widget on a dashboard the authenticated user can write to.

Requires MEMBER role or higher in the project's workspace (the write service decides). Strict create — never idempotent, created is always true on success.

Args: request (Request): Incoming request (rate-limit plumbing). response (Response): Outgoing response (rate-limit plumbing). auth (AccountStampedAuth): Account-scope user auth (session token or CLI access JWT); its resolved user_id becomes the actor. payload (CreateWidgetRequest): The widget to create. _live (None): Write-path liveness gate (blocks a revoked JWT session).

Returns: CreateWidgetResponse: The created widget.