F-003 fix: Sanitize SQL dump for safe dev use

spec/product.md

@@ -47,3 +47,26 @@ Keep page behavior the same while removing hard-coded secrets from tracked PHP f
   - auth redesign
   - worker refactor beyond config use
   - deploy automation
+
+## F-003 — Sanitize SQL dump for safe dev use
+
+### Problem
+Current SQL dump in repo looks like a production snapshot.
+It contains sensitive and production-like data.
+This is unsafe as a tracked development baseline.
+
+### Objective
+Replace the raw dump in the working tree with a safe development baseline.
+Keep local development possible for the legacy PHP module.
+Document how to handle private data outside git.
+
+### Scope
+- In scope:
+  - define safe SQL baseline strategy
+  - replace current tracked dump with sanitized development dump
+  - document private local dump handling
+  - keep module development possible with synthetic seed data
+- Out of scope:
+  - production database changes
+  - app logic changes
+  - full OpenCart dataset preservation