feat(F-087): completed feature

work/artifacts/F-087/security.json

@@ -0,0 +1,15 @@
+{
+  "feature_id": "F-087",
+  "verdict": "APPROVED",
+  "checks": [
+    { "name": "No new attack surface", "result": "PASS", "notes": "Same inventory check used elsewhere; no new deps." },
+    { "name": "Error messages do not leak sensitive data", "result": "PASS", "notes": "Message exposes only variantId, requested, availableQuantity — all already known to the UI." },
+    { "name": "Auth chain unchanged", "result": "PASS", "notes": "Same cart routes; new error path goes through existing auth." }
+  ],
+  "sast": "PASS",
+  "dependency_review": "PASS",
+  "secret_scan": "PASS",
+  "verdict_reason": "Server-side validation strengthened; UI enforces the same cap.",
+  "reviewer": "security",
+  "reviewed_at": "2026-08-20T04:17:30Z"
+}