feat(F-095): completed feature

work/artifacts/F-095/security.json

@@ -0,0 +1,14 @@
+{
+  "feature_id": "F-095",
+  "agent": "security",
+  "verdict": "APPROVED",
+  "summary": "Remote imports remain authenticated and constrained to public HTTP(S) image resources with redirect, size, MIME, and binary signature checks.",
+  "evidence": [
+    "Upload route requires authenticated backoffice session before remote fetch",
+    "localhost, local hostnames, private IPv4, and private IPv6 destinations are rejected",
+    "Only image MIME types supported by the existing upload pipeline are accepted",
+    "10MB limit, timeout, limited redirects, and image magic-byte validation are enforced",
+    "Remote URL is never stored directly as a product image"
+  ],
+  "timestamp": "2026-08-20T20:05:20Z"
+}