feat(F-056): completed feature

backlog/features.json

@@ -2957,6 +2957,102 @@
         "close": true
       },
       "completed_at": "2026-08-19T11:48:32Z"
+    },
+    {
+      "id": "F-056",
+      "type": "fix",
+      "title": "Serve uploads dynamic and fix image overflow",
+      "problem": "New uploads give 404 and next image gives 502; product detail image overflows page",
+      "goal": "Uploads must work right after upload without restart, thumbs auto-made, images stay inside box",
+      "scope_in": [
+        "Uploads route handler",
+        "Thumbnail generation on upload",
+        "Frontend detail image container"
+      ],
+      "scope_out": [
+        "No CDN",
+        "No S3"
+      ],
+      "priority": "high",
+      "risk": "low",
+      "description": "Problem: New uploads give 404 and next image gives 502; product detail image overflows page. Goal: Uploads must work right after upload without restart, thumbs auto-made, images stay inside box. Scope IN: Uploads route handler, Thumbnail generation on upload, Frontend detail image container. Scope OUT: No CDN, No S3. Type: fix. Priority: high. Risk: low.",
+      "acceptance": [
+        "New upload file loads 200 without server restart",
+        "Thumbs 40 and 200 exist right after upload",
+        "next/image no more 502 for fresh uploads",
+        "Product detail image stays inside its box",
+        "verify.sh is green"
+      ],
+      "status": "done",
+      "created_at": "2026-08-19",
+      "gates": {
+        "reviewer": true,
+        "security": true,
+        "qa": true,
+        "close": true
+      },
+      "completed_at": "2026-08-19T13:10:09Z"
+    },
+    {
+      "id": "F-057",
+      "type": "bug",
+      "title": "Fix checkout 400 INVALID_CART missing items in body",
+      "problem": "CheckoutClient does not send items array to /api/checkout but route requires it",
+      "goal": "POST /api/checkout succeeds with valid cart and auth, items mapped from CartContext",
+      "scope_in": [
+        "CheckoutClient handlePlaceOrder body",
+        "route schema sanity check"
+      ],
+      "scope_out": [
+        "No payment redesign",
+        "no schema migration"
+      ],
+      "priority": "high",
+      "risk": "low",
+      "description": "Problem: CheckoutClient does not send items array to /api/checkout but route requires it. Goal: POST /api/checkout succeeds with valid cart and auth, items mapped from CartContext. Scope IN: CheckoutClient handlePlaceOrder body, route schema sanity check. Scope OUT: No payment redesign, no schema migration. Type: bug. Priority: high. Risk: low.",
+      "acceptance": [
+        "CheckoutClient sends items from CartContext in POST body",
+        "POST /api/checkout from /checkout with valid session returns 200 or redirect",
+        "No regression in existing cart or order flow",
+        "verify.sh is green"
+      ],
+      "status": "pending",
+      "created_at": "2026-08-19",
+      "gates": {
+        "reviewer": false,
+        "security": false,
+        "qa": false
+      }
+    },
+    {
+      "id": "F-058",
+      "type": "bug",
+      "title": "Fix admin products list shows leaf emoji instead of new thumbnail",
+      "problem": "Backend /catalog/products and /products/search return images=[] because serializeProduct is called without images arg",
+      "goal": "Admin /products table shows product thumbnail 40px from images[0].url and /products/search returns attached images",
+      "scope_in": [
+        "Backend list endpoints fetch images for listed product IDs and pass to serializeProduct"
+      ],
+      "scope_out": [
+        "Admin products page uses p.images[0].url with /uploads/40/ prefix"
+      ],
+      "priority": "high",
+      "risk": "low",
+      "description": "Problem: Backend /catalog/products and /products/search return images=[] because serializeProduct is called without images arg. Goal: Admin /products table shows product thumbnail 40px from images[0].url and /products/search returns attached images. Scope IN: Backend list endpoints fetch images for listed product IDs and pass to serializeProduct. Scope OUT: Admin products page uses p.images[0].url with /uploads/40/ prefix. Type: bug. Priority: high. Risk: low.",
+      "acceptance": [
+        "GET /api/catalog/products returns images[] for products that have attached images",
+        "GET /api/products/search returns images[] for products that have attached images",
+        "Admin /products table shows 40px thumbnail (not leaf) for products with images",
+        "Existing uploads pipeline is not broken",
+        "verify.sh is green"
+      ],
+      "status": "pending",
+      "created_at": "2026-08-19",
+      "gates": {
+        "reviewer": false,
+        "security": false,
+        "qa": false
+      }
     }
   ]
 }