feat(F-149): completed feature

work/artifacts/F-149/security.json

@@ -0,0 +1,13 @@
+{
+  "feature_id": "F-149",
+  "agent": "security",
+  "stage": "security_gate",
+  "verdict": "APPROVED",
+  "summary": "Fully parameterized SQL CTE. All user input (dates, UUIDs, channel) via $1..$8 placeholders. RBAC enforced via requireReportingPermission('REPORTING_PRODUCTS'). No new secrets.",
+  "checks": [
+    {"item": "SQL injection prevention", "ok": true, "evidence": "All user values: $1..$8 parameterized; sortBy is validated ('units_sold'|'gross_sales_cents'), not interpolated as user string"},
+    {"item": "Authentication", "ok": true, "evidence": "requireReportingPermission('REPORTING_PRODUCTS') on GET /reporting/products"},
+    {"item": "No new secrets", "ok": true, "evidence": "No env vars or credentials added"}
+  ],
+  "issues": []
+}