feat(F-095): completed feature

work/artifacts/F-095/implementer.md

@@ -0,0 +1,14 @@
+# F-095 — Implementer evidence
+
+## Changes
+
+- Removed the erroneous empty `productsApi.update(productId, {})` call from URL image attachment.
+- The admin image editor now sends `{ url }` to `/api/upload`, then attaches the returned local `/uploads/...` URL to the product.
+- `/api/upload` now supports authenticated JSON URL imports: validates public HTTP(S) hosts, follows limited redirects, accepts only supported image MIME/signatures, enforces the 10MB limit, stores locally, mirrors peers, and generates thumbnails.
+- Existing multipart file upload behavior uses the shared local save helper.
+
+## Validation
+
+- Admin `npx tsc --noEmit` → exit 0
+- Admin ESLint on upload route and ImagesSection → 0 errors
+- Admin production build → exit 0