feat(F-096): completed feature

work/artifacts/F-096/implementer.md

@@ -0,0 +1,14 @@
+# F-096 — Implementer evidence
+
+## Changes
+
+- Added AI settings to admin Ajustes: provider, OpenAI-compatible base URL, model, API key, and separate SEO title/description prompts with `{{name}}`, `{{description}}`, and `{{brand}}` variables.
+- API keys are never returned by GET settings; only `aiApiKeyConfigured` is exposed.
+- Added authenticated `POST /products/:id/generate-seo`, which calls the configured chat-completions endpoint only for empty SEO fields and persists generated values.
+- ProductEditor calls generation after save when either SEO field is empty; manually entered values are preserved.
+
+## Validation
+
+- Root `npm run typecheck` → exit 0
+- Admin `npx tsc --noEmit` → exit 0
+- Admin ESLint on touched files → 0 errors (warnings only)

work/artifacts/F-096/leader-close.json

@@ -0,0 +1,15 @@
+{
+  "feature_id": "F-096",
+  "agent": "leader",
+  "verdict": "APPROVED",
+  "summary": "F-096 adds configurable OpenAI-compatible AI SEO generation for empty product SEO fields without overwriting manual values.",
+  "evidence": [
+    "reviewer.json verdict=APPROVED",
+    "security.json verdict=APPROVED",
+    "qa.json verdict=APPROVED",
+    "Backend and admin production builds exit 0",
+    "Root tests: 133 passed, 56 skipped",
+    "scripts/verify.sh exit 0"
+  ],
+  "timestamp": "2026-08-20T20:12:20Z"
+}

work/artifacts/F-096/qa.json

@@ -0,0 +1,15 @@
+{
+  "feature_id": "F-096",
+  "agent": "qa",
+  "verdict": "APPROVED",
+  "summary": "AI settings and empty SEO generation pass typechecks, builds, tests, and harness verification.",
+  "evidence": [
+    "Root npm run typecheck exit 0",
+    "Root npm run build exit 0",
+    "Admin npx tsc --noEmit exit 0",
+    "Admin npm run build exit 0",
+    "Root tests: 133 passed, 56 skipped",
+    "scripts/verify.sh exit 0"
+  ],
+  "timestamp": "2026-08-20T20:12:10Z"
+}

work/artifacts/F-096/reviewer.json

@@ -0,0 +1,13 @@
+{
+  "feature_id": "F-096",
+  "agent": "reviewer",
+  "verdict": "APPROVED",
+  "summary": "Settings expose the requested AI configuration and field-specific prompts; product SEO generation is explicit about filling only empty fields.",
+  "evidence": [
+    "Ajustes includes provider, base URL, model, API key, and separate SEO prompts",
+    "POST /products/:id/generate-seo checks each field independently before generation",
+    "ProductEditor invokes generation after save only when a field is empty",
+    "Manual SEO values are not overwritten"
+  ],
+  "timestamp": "2026-08-20T20:11:00Z"
+}

work/artifacts/F-096/security.json

@@ -0,0 +1,14 @@
+{
+  "feature_id": "F-096",
+  "agent": "security",
+  "verdict": "APPROVED",
+  "summary": "The AI key stays server-side and is omitted from settings responses; generation is admin-authenticated and only writes empty SEO fields.",
+  "evidence": [
+    "GET settings returns aiApiKey as empty and only exposes aiApiKeyConfigured",
+    "AI provider calls occur in the backend with the key in an Authorization header",
+    "Generation endpoint requires admin authentication",
+    "No client-side provider call or API key exposure",
+    "Generated output is length-bounded before persistence"
+  ],
+  "timestamp": "2026-08-20T20:11:20Z"
+}