feat(F-157): completed feature

work/artifacts/F-157/security.json

@@ -0,0 +1,13 @@
+{
+  "feature_id": "F-157",
+  "agent": "security",
+  "stage": "security_gate",
+  "verdict": "APPROVED",
+  "summary": "Sin cambios de autenticación ni autorización; Reporting conserva el permiso reporting.read del menú principal y las rutas backend mantienen RBAC existente.",
+  "checks": [
+    { "item": "RBAC unchanged", "ok": true, "evidence": "Only navigation presentation changed" },
+    { "item": "Static internal links", "ok": true, "evidence": "All section hrefs are hard-coded same-origin paths" },
+    { "item": "No secret or dependency change", "ok": true, "evidence": "No config secrets or packages modified" }
+  ],
+  "issues": []
+}