fix(audit): UI — L18 (decorative emoji -> Lucide icons), L19 (gated NotesList timer + create-from-url ref-in-effect)

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

src/hooks/use-create-from-url.ts

@@ -1,6 +1,6 @@
 'use client';
 
-import { useEffect } from 'react';
+import { useEffect, useRef } from 'react';
 import { useRouter, useSearchParams } from 'next/navigation';
 
 /**
@@ -14,14 +14,24 @@ export function useCreateFromUrl(onOpen: () => void): void {
   const searchParams = useSearchParams();
   const router = useRouter();
 
+  // Keep the latest `onOpen` in a ref so the effect can call it without
+  // depending on it. Callers commonly pass an inline arrow (a fresh
+  // identity every render); listing it as a dep would re-run the effect
+  // and re-pop the sheet on every parent re-render. The ref lets us drop
+  // the eslint-disable while still always invoking the current callback.
+  // (Assigned in an effect, not during render, to satisfy react-hooks/refs.)
+  const onOpenRef = useRef(onOpen);
+  useEffect(() => {
+    onOpenRef.current = onOpen;
+  }, [onOpen]);
+
   useEffect(() => {
     if (searchParams.get('create') !== '1') return;
-    onOpen();
+    onOpenRef.current();
     const params = new URLSearchParams(searchParams.toString());
     params.delete('create');
     const newUrl = params.toString() ? `?${params.toString()}` : window.location.pathname;
     // typedRoutes can't statically validate a same-route replace; cast is safe.
     router.replace(newUrl as never);
-    // eslint-disable-next-line react-hooks/exhaustive-deps
-  }, [searchParams]);
+  }, [searchParams, router]);
 }