fix(15): exclude soft-deleted notes/time entries from phishing evidence

ticket_notes and time_entries both carry an is_deleted soft-delete flag
(per CLAUDE.md audit-column convention); gatherTicketEvidence was reading
both without filtering it, so retracted notes and reversed time entries
showed up as evidence for every phishing report. Found during code-review
re-verification of the Phase 15 CR-01/WR-01/WR-02 fixes.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_012wWroM6FXkQJiH3JgYcony

lib/services/phishing-detector.ts

@@ -127,6 +127,7 @@ export async function gatherTicketEvidence(
     `SELECT id, title, description, note_type, creator_resource_id, created_at
        FROM ticket_notes
       WHERE ticket_id = $1
+        AND is_deleted = false
       ORDER BY created_at`,
     [ticket.id]
   );
@@ -135,6 +136,7 @@ export async function gatherTicketEvidence(
     `SELECT id, resource_id, entry_date, hours_worked, start_date_time, end_date_time
        FROM time_entries
       WHERE ticket_id = $1
+        AND is_deleted = false
       ORDER BY entry_date`,
     [ticket.id]
   );