Persist an Enterprise "contact us" inquiry, then best-effort alert the founders.

Public — unauthenticated calls are accepted (the marketing site has no session). When a Supabase-JWT Bearer token IS present and verifies, org_id is attached from the token — NEVER trusted from the request body (same hybrid-auth pattern as POST /api/promo/enrichment/register).

Persists FIRST; the lead row is the system of record. Founder notification is best-effort and its failure must never fail this request — the lead is already saved. Always answers 200 on an accepted submission, including honeypot hits, so a public form never reveals detection to the caller; only a genuine persistence failure returns an error.