feat(F-141): completed feature

work/artifacts/F-141/security.json

@@ -0,0 +1,17 @@
+{
+  "feature_id": "F-141",
+  "agent": "security",
+  "stage": "security_gate",
+  "verdict": "APPROVED",
+  "reviewed_at": "2026-08-21T20:02:30Z",
+  "summary": "El cambio solo afecta a la configuración de build y al momento de ejecución de lecturas públicas del catálogo. No amplía permisos, no expone secretos y no modifica endpoints.",
+  "checks": [
+    {"item":"No secrets committed","ok":true,"evidence":"No .env files or credentials modified; NEXT_PUBLIC_API_URL remains environment-provided"},
+    {"item":"No API security bypass","ok":true,"evidence":"Runtime requests continue through existing fetch functions and backend routes"},
+    {"item":"No sensitive data moved to build output","ok":true,"evidence":"Catalog pages are server-rendered on demand instead of serializing failed/build-time API data"},
+    {"item":"Workspace isolation safe","ok":true,"evidence":"Both Turbopack and output tracing roots are constrained to project/frontend"},
+    {"item":"Error behavior remains explicit","ok":true,"evidence":"Required catalog fetches still throw on HTTP/network failures at runtime; no silent empty mock is returned"}
+  ],
+  "issues": [],
+  "notes":"Dynamic server rendering may expose runtime availability errors to the normal Next error boundary if the backend is down. This is preferable to silently shipping an empty catalog and is unchanged from the existing runtime semantics."
+}