lotus(#2): address review — ack contract, rate, param precedence

- Document that io.lotus.call_state is request/response and the host must
  ack it (cinny listenAction replies {}) to avoid 10s-timeout churn (H1).
- Throttle 150ms -> 250ms to reduce widget traffic (M1).
- lotusParam: hash fragment wins over query, matching EC's ParamParser (L1).
- Fix the misleading "opaque" id comment; id is userId:deviceId (L2).

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

src/lotus/lotusWidget.ts

@@ -30,10 +30,12 @@ let cachedParams: URLSearchParams | undefined;
  */
 export function lotusParam(name: string): string | null {
   if (!cachedParams) {
-    cachedParams = new URLSearchParams(window.location.search);
+    // Match EC's own ParamParser precedence: the hash fragment wins over the
+    // query string. So seed from the fragment first, then fill gaps from query.
     const hash = window.location.hash.replace(/^#\/?/, "");
     const hashQuery = hash.includes("?") ? hash.slice(hash.indexOf("?") + 1) : "";
-    for (const [k, v] of new URLSearchParams(hashQuery)) {
+    cachedParams = new URLSearchParams(hashQuery);
+    for (const [k, v] of new URLSearchParams(window.location.search)) {
       if (!cachedParams.has(k)) cachedParams.append(k, v);
     }
   }