fix(audit): UI — L18 (decorative emoji -> Lucide icons), L19 (gated NotesList timer + create-from-url ref-in-effect)

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

src/app/(dashboard)/[portSlug]/expenses/layout.tsx

@@ -1,3 +1,4 @@
+import { notFound } from 'next/navigation';
 import { eq } from 'drizzle-orm';
 
 import { db } from '@/lib/db';
@@ -29,7 +30,10 @@ export default async function ExpensesLayout({ children, params }: ExpensesLayou
     where: eq(portsTable.slug, portSlug),
     columns: { id: true },
   });
-  if (!port) return children;
+  // Fail closed: an unresolved slug means the port doesn't exist (or the
+  // user mistyped one) — 404 rather than silently rendering the gated
+  // subtree without a module check.
+  if (!port) notFound();
   const enabled = await isExpensesModuleEnabled(port.id);
   if (enabled) return children;
   return (