feat(F-094): completed feature

work/artifacts/F-094/security.json

@@ -0,0 +1,13 @@
+{
+  "feature_id": "F-094",
+  "agent": "security",
+  "verdict": "APPROVED",
+  "summary": "The UI uses the existing authenticated admin variant endpoint; server-side SKU/EAN validation and uniqueness remain authoritative.",
+  "evidence": [
+    "No new backend route or authorization bypass",
+    "SKU is required in the UI and backend schema validates all fields",
+    "Duplicate SKU/EAN remains rejected by database constraints",
+    "No secrets, unsafe HTML, or dependencies added"
+  ],
+  "timestamp": "2026-08-20T20:01:20Z"
+}