# F-095 — Implementer evidence

## Changes

- Removed the erroneous empty `productsApi.update(productId, {})` call from URL image attachment.
- The admin image editor now sends `{ url }` to `/api/upload`, then attaches the returned local `/uploads/...` URL to the product.
- `/api/upload` now supports authenticated JSON URL imports: validates public HTTP(S) hosts, follows limited redirects, accepts only supported image MIME/signatures, enforces the 10MB limit, stores locally, mirrors peers, and generates thumbnails.
- Existing multipart file upload behavior uses the shared local save helper.

## Validation

- Admin `npx tsc --noEmit` → exit 0
- Admin ESLint on upload route and ImagesSection → 0 errors
- Admin production build → exit 0