fix(audit): UI — L18 (decorative emoji -> Lucide icons), L19 (gated NotesList timer + create-from-url ref-in-effect)

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

src/app/api/v1/dashboard/forecast/route.ts

@@ -19,6 +19,9 @@ export const GET = withAuth(
     const range = rangeSlug ? parseRangeSlug(rangeSlug) : null;
     const bounds = range ? rangeToBounds(range) : null;
     const result = await getRevenueForecast(ctx.portId, bounds);
+    // L34 carve-out: deliberate bare-shape response (NOT the `{ data }`
+    // envelope). The dashboard widgets read these fields off the root of
+    // the JSON; wrapping them would break the consumers. Left as-is.
     return NextResponse.json(result);
   }),
 );