feat(F-072): completed feature

work/artifacts/F-072/security.json

@@ -0,0 +1,17 @@
+{
+  "feature_id": "F-072",
+  "agent": "security",
+  "verdict": "APPROVED",
+  "summary": "F-072 adds a new allowed value ('super-reduced') to an existing database column with a CHECK constraint, and extends TypeScript union types. No new dependencies, no new endpoints, no auth changes. The backend Zod schema validates the vatRate field (already validated before this change, now accepts 3 values instead of 2). No XSS or injection risk.",
+  "evidence": [
+    "No new dependencies added to any package.json",
+    "No new API endpoints — only extended an existing enum value",
+    "No auth/authz changes — existing admin role gate applies to all pricing endpoints",
+    "No env vars introduced",
+    "Migration adds 'super-reduced' to allowed CHECK constraint values — additive change, no data risk",
+    "TypeScript types extended (union types) — purely compile-time safety",
+    "Zod schema in pricing.routes.ts accepts 'super-reduced' — validated server-side before DB write",
+    "verify.sh exit 0"
+  ],
+  "timestamp": "2026-08-19T17:23:00Z"
+}