chore(dash-remove-variants-card): dashboard: remove variants KPI cards (Sin stock + Alertas)

work/artifacts/DASH-REMOVE-VARIANTS-CARD/security.json

@@ -0,0 +1,69 @@
+{
+  "feature_id": "DASH-REMOVE-VARIANTS-CARD",
+  "verdict": "APPROVED",
+  "agent": "security",
+  "security": "security",
+  "reviewed_at": "2026-08-27T21:28:40Z",
+  "scope": [
+    "project/apps/admin/src/app/(dashboard)/page.tsx"
+  ],
+  "summary": "Pure UI removal. Cero impacto en superficie de seguridad: sin cambios en auth, sin cambios en CORS, sin cambios en cookies, sin nuevos endpoints, sin nuevas queries SQL, sin eval/source/dangerouslySetInnerHTML. Eliminar cards reduce ligeramente la superficie visible (menos hrefs salientes, menos rutas accesibles desde el dashboard). Aprobado.",
+  "checks": [
+    {
+      "id": "no-auth-change",
+      "description": "Sin cambios en auth",
+      "command": "git diff project/apps/admin/src/app/(dashboard)/page.tsx | grep -iE 'auth|login|cookie|token|session'",
+      "result": "PASS",
+      "evidence": "Sin matches. El dashboard sigue usando la misma sesión backoffice que ya tenía."
+    },
+    {
+      "id": "no-xss-regression",
+      "description": "Sin nuevos vectores XSS",
+      "command": "git diff project/apps/admin/src/app/(dashboard)/page.tsx | grep -E 'dangerouslySetInnerHTML|innerHTML|eval\\('",
+      "result": "PASS",
+      "evidence": "Sin matches. Renderiza texto vía {label}, {value}, {sub}, {icon} que React escapa automáticamente. Sin HTML crudo."
+    },
+    {
+      "id": "no-new-hrefs",
+      "description": "Solo se eliminan hrefs (no se añaden)",
+      "command": "git diff project/apps/admin/src/app/(dashboard)/page.tsx | grep -E 'href='",
+      "result": "PASS",
+      "evidence": "Solo aparecen los hrefs eliminados (los de los cards variants). Cero hrefs nuevos."
+    },
+    {
+      "id": "no-cors-change",
+      "description": "Sin cambios en CORS/headers/cookies",
+      "command": "git diff project/ | grep -iE 'cors|access-control|set-cookie|headers'",
+      "result": "PASS",
+      "evidence": "Sin matches. La config CORS del proyecto no se tocó."
+    },
+    {
+      "id": "no-secrets",
+      "description": "Cero secretos",
+      "command": "git diff project/ | grep -iE 'password|secret|token|api[_-]?key' | grep -v test",
+      "result": "PASS",
+      "evidence": "Sin matches."
+    },
+    {
+      "id": "no-new-deps",
+      "description": "Cero nuevas dependencias",
+      "command": "git diff --name-only -- '*package.json'",
+      "result": "PASS",
+      "evidence": "Sin cambios en package.json."
+    },
+    {
+      "id": "reduced-attack-surface",
+      "description": "Reducción ligera de superficie de ataque",
+      "command": "code review",
+      "result": "PASS",
+      "evidence": "Se eliminan 2 hrefs (`/inventory` como 'Revisar inventario' implícito y el de la card Sin stock). Cero nuevas rutas accesibles. Marginal positivo para security."
+    }
+  ],
+  "findings": [],
+  "verdict_rationale": "Remoción pura de UI sin implicaciones de seguridad. Surface reduction mínima pero en la dirección correcta. APPROVED.",
+  "evidence_paths": [
+    "work/artifacts/DASH-REMOVE-VARIANTS-CARD/implementer.md",
+    "work/artifacts/DASH-REMOVE-VARIANTS-CARD/reviewer.json",
+    "project/apps/admin/src/app/(dashboard)/page.tsx"
+  ]
+}