Publish current project state

backend/internal/handler/widget/widget_handler.go

@@ -979,6 +979,8 @@ func (h *WidgetHandler) PublicInboxShow(c *gin.Context) {
 	c.JSON(http.StatusOK, payload)
 }
 
+// Public widget requests are not a trusted connector boundary. Origin headers
+// are never promoted into internal event context here.
 func (h *WidgetHandler) PublicCreateContact(c *gin.Context) {
 	req, err := bindPublicContactRequest(c)
 	if err != nil {