feat(F-097): completed feature

work/artifacts/F-097/implementer.md

@@ -0,0 +1,10 @@
+# F-097 — Implementer evidence
+
+- Fixed the admin catch-all POST proxy: it no longer sends `Content-Type: application/json` when the request has no body.
+- This allows `POST /api/products/:id/generate-seo` to reach the backend; previously Fastify rejected the empty request with `FST_ERR_CTP_EMPTY_JSON_BODY` (400).
+- Rebuilt and restarted the production monolith.
+
+Validation:
+- Admin production build: exit 0
+- Authenticated `/api/admin/settings`: HTTP 200
+- Authenticated empty-body SEO request: HTTP 422 `AI_NOT_CONFIGURED` with actionable message (instead of HTTP 400)

work/artifacts/F-097/leader-close.json

@@ -0,0 +1,14 @@
+{
+  "feature_id": "F-097",
+  "agent": "leader",
+  "verdict": "APPROVED",
+  "summary": "F-097 fixes the admin proxy empty JSON body error that caused generate-seo HTTP 400; settings now loads through :3004 and missing AI configuration returns 422 with a clear message.",
+  "evidence": [
+    "reviewer.json APPROVED",
+    "security.json APPROVED",
+    "qa.json APPROVED",
+    "Production services restarted and health checks return 200",
+    "verify.sh green"
+  ],
+  "timestamp": "2026-08-20T20:33:10Z"
+}

work/artifacts/F-097/qa.json

@@ -0,0 +1,16 @@
+{
+  "feature_id": "F-097",
+  "agent": "qa",
+  "verdict": "APPROVED",
+  "summary": "Proxy fix passes typechecks, tests, verify, production build, and authenticated smoke checks.",
+  "evidence": [
+    "Root npm run typecheck exit 0",
+    "Admin npx tsc --noEmit exit 0",
+    "Tests: 133 passed, 56 skipped",
+    "Admin production build exit 0",
+    "Authenticated settings proxy: HTTP 200",
+    "Authenticated bodyless generate-seo proxy: HTTP 422 AI_NOT_CONFIGURED (expected with empty database configuration)",
+    "scripts/verify.sh exit 0"
+  ],
+  "timestamp": "2026-08-20T20:33:00Z"
+}

work/artifacts/F-097/reviewer.json

@@ -0,0 +1,12 @@
+{
+  "feature_id": "F-097",
+  "agent": "reviewer",
+  "verdict": "APPROVED",
+  "summary": "The proxy fix is minimal and preserves JSON headers for non-empty requests while allowing bodyless POST endpoints.",
+  "evidence": [
+    "POST proxy conditionally sets Content-Type only when a body exists",
+    "Authenticated settings request through :3004 returns 200",
+    "Authenticated SEO request through :3004 reaches backend and returns AI_NOT_CONFIGURED 422"
+  ],
+  "timestamp": "2026-08-20T20:32:30Z"
+}

work/artifacts/F-097/security.json

@@ -0,0 +1,13 @@
+{
+  "feature_id": "F-097",
+  "agent": "security",
+  "verdict": "APPROVED",
+  "summary": "The change only alters proxy header/body consistency; cookies remain forwarded and backend errors remain in the existing envelope.",
+  "evidence": [
+    "No credentials or API keys are added to client responses",
+    "The backoffice cookie continues to be forwarded to the backend",
+    "Non-empty JSON requests retain their Content-Type header",
+    "Backend returns actionable status/code without exposing provider secrets"
+  ],
+  "timestamp": "2026-08-20T20:32:40Z"
+}