feat(F-058): completed feature

work/artifacts/F-058/security.json

@@ -0,0 +1,15 @@
+{
+  "feature_id": "F-058",
+  "agent": "security",
+  "verdict": "APPROVED",
+  "summary": "No new attack surface. listByProductIds is parameterised via pg's parameterised query (ANY($1::uuid[])). UUIDs come from the trusted products table, not from user input. Frontend change only swaps one dead prop for an existing API field. No auth boundary change.",
+  "evidence": [
+    "listByProductIds uses parameterised query with productIds typed as uuid[] — no SQL injection vector",
+    "Auth on /catalog/products unchanged: still requires admin role (requireRole(user, 'admin'))",
+    "Auth on /products/search unchanged: public endpoint, returns the same data shape that was already exposed (just with the actual images instead of empty array)",
+    "No new env vars, secrets, or external calls",
+    "Path traversal on the dynamic thumbnail URL is mitigated at the dynamic /uploads/[...path] handler with regex validation (covered by F-056)",
+    "git diff shows zero touches outside the catalog module and the admin products page"
+  ],
+  "timestamp": "2026-08-19T13:50:00Z"
+}