fix(audit): UI — L18 (decorative emoji -> Lucide icons), L19 (gated NotesList timer + create-from-url ref-in-effect)

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

src/app/api/public/website-inquiries/route.ts

@@ -169,6 +169,11 @@ export async function POST(req: NextRequest) {
       },
       'website inquiry captured',
     );
+    // L34 carve-out: deliberate bespoke `{ id, deduped }` shape (NOT the
+    // `{ data }` envelope). This is the public website's intake contract —
+    // the external marketing site reads `id`/`deduped` off the JSON root.
+    // Both return sites below share this shape on purpose. Changing it
+    // would be a breaking cross-repo change.
     return NextResponse.json({ id: insertResult[0].id, deduped: false });
   }