fix(sw): bump SW version to 41; fix page guard fallback to avoid loops

pos/static/js/app-init.js

@@ -223,9 +223,36 @@
 
     function enforcePageGuard(userRole, userPerms) {
         if (isPageAllowed(path, userRole, userPerms)) return true;
-        var fallback = '/pos/catalog';
-        if (userRole === 'counter' || userRole === 'cashier') fallback = '/pos/sale';
-        else if (userRole === 'workshop' || userRole === 'mechanic') fallback = '/pos/workshop';
+        // Build the actual list of allowed pages so we can pick a safe fallback.
+        var fallback = null;
+        if (userRole === 'owner' || userRole === 'admin') {
+            fallback = '/pos/dashboard';
+        } else if (['workshop', 'mechanic', 'counter', 'cashier'].indexOf(userRole) !== -1) {
+            var allowed = [];
+            if (userRole === 'workshop' || userRole === 'mechanic') allowed = ['/pos/workshop'];
+            var permMap = {
+                'pos.sell': '/pos/sale',
+                'pos.view': '/pos/sale',
+                'catalog.view': '/pos/catalog',
+                'inventory.view': '/pos/inventory',
+                'customers.view': '/pos/customers',
+                'workshop.view': '/pos/workshop',
+                'pos.remission': '/pos/remission-notes',
+                'invoicing.view': '/pos/invoicing',
+                'quotations.view': '/pos/quotations',
+                'accounting.view': '/pos/accounting',
+                'reports.view': '/pos/reports',
+                'dashboard.view': '/pos/dashboard'
+            };
+            for (var p in permMap) {
+                if (userPerms.indexOf(p) !== -1 && allowed.indexOf(permMap[p]) === -1) {
+                    allowed.push(permMap[p]);
+                }
+            }
+            fallback = allowed.length ? allowed[0] : '/pos/login';
+        } else {
+            fallback = '/pos/dashboard';
+        }
         window.location.replace(fallback);
         return false;
     }

pos/static/pwa/sw.js

@@ -6,7 +6,7 @@
 // The fetch handler normalizes static asset URLs (strips ?v= query strings)
 // so templates can use cache-busting query params freely.
 
-const VERSION = 40;
+const VERSION = 41;
 const CACHE_NAME = 'nexus-pos-v' + VERSION;
 
 const APP_SHELL = [