feat(F-105): completed feature

work/artifacts/F-105/implementer.md

@@ -0,0 +1,5 @@
+# F-105 — Customer account preferences (in progress)
+
+- Migration: users_profiles.preferences jsonb.
+- Users module: preferences in domain/repo/routes (GET/PATCH /users/:id).
+- Frontend account page: Preferencias section (order updates, newsletter, promos).

work/artifacts/F-105/leader-close.json

@@ -0,0 +1,8 @@
+{
+  "feature_id": "F-105",
+  "agent": "leader",
+  "verdict": "APPROVED",
+  "summary": "F-105 delivers full customer self-service: data, addresses and preferences from the storefront account page.",
+  "evidence": ["reviewer.json APPROVED", "security.json APPROVED", "qa.json APPROVED"],
+  "timestamp": "2026-08-21T06:21:30Z"
+}

work/artifacts/F-105/qa.json

@@ -0,0 +1,13 @@
+{
+  "feature_id": "F-105",
+  "agent": "qa",
+  "verdict": "APPROVED",
+  "summary": "Backend tests and builds green; migration applied; preferences merge verified against live DB; services restarted healthy.",
+  "evidence": [
+    "npm test: 133 passed, 56 skipped; backend and frontend builds exit 0",
+    "Migration 035_users_preferences applied",
+    "Repo smoke: partial merge produced {orderUpdates:true,newsletter:true,promos:false}, revert ok",
+    "health/frontend/admin HTTP 200 after restart; verify.sh green"
+  ],
+  "timestamp": "2026-08-21T06:21:00Z"
+}

work/artifacts/F-105/reviewer.json

@@ -0,0 +1,13 @@
+{
+  "feature_id": "F-105",
+  "agent": "reviewer",
+  "verdict": "APPROVED",
+  "summary": "Customers can now manage personal data, addresses and notification/marketing preferences from /account, reachable from the header icon.",
+  "evidence": [
+    "users_profiles gains preferences jsonb (migration 035) with repo merge semantics",
+    "GET /users/:id returns preferences; PATCH accepts partial preferences object (owner or admin only)",
+    "Account page adds Preferencias section with accessible toggle switches and optimistic save with rollback",
+    "UserMenu links to /account when logged in"
+  ],
+  "timestamp": "2026-08-21T06:20:00Z"
+}

work/artifacts/F-105/security.json

@@ -0,0 +1,13 @@
+{
+  "feature_id": "F-105",
+  "agent": "security",
+  "verdict": "APPROVED",
+  "summary": "Preference writes are authenticated, owner-scoped and strictly validated; SQL stays parameterized.",
+  "evidence": [
+    "PATCH /users/:id keeps requireOwnerOrAdmin guard",
+    "zod strict schema allows only three boolean keys; unknown keys rejected",
+    "preferences merged via COALESCE(preferences,'{}')||$n::jsonb parameterized query",
+    "No secret or PII exposure added"
+  ],
+  "timestamp": "2026-08-21T06:20:30Z"
+}